[v1] Bluetooth: btinel: Check ACPI handle for NULL before accessing

Commit Message

K, Kiran March 8, 2023, 7:58 a.m. UTC

Older platforms and Virtual platforms which doesn't have support for
bluetooth device in ACPI firmware will not have valid ACPI handle. Check
for validity of handle before accessing.

dmesg log from simics environment (virtual platform):

BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
IP: acpi_ns_walk_namespace+0x5c/0x278
PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
Modules linked in: bnep intel_powerclamp coretemp kvm_intel kvm irqbypass intel_cstate input_leds joydev serio_raw mac_hid btusb(OE) btintel(OE) bluetooth(OE) lpc_ich compat(OE) ecdh_generic i7core_edac i5500_temp shpchp binfmt_misc sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid e1000e psmouse ahci pata_acpi libahci ptp pps_core floppy
CPU: 0 PID: 35 Comm: kworker/u3:0 Tainted: G           OE    4.15.0-140-generic #144-Ubuntu
Hardware name: Simics Simics, BIOS Simics 01/01/2011
Workqueue: hci0 hci_power_on [bluetooth]
RIP: 0010:acpi_ns_walk_namespace+0x5c/0x278
RSP: 0000:ffffaa9c0049bba8 EFLAGS: 00010246
RAX: 0000000000000001 RBX: 0000000000001001 RCX: 0000000000000010
RDX: ffffffff92ea7e27 RSI: ffffffff92ea7e10 RDI: 00000000000000c8
RBP: ffffaa9c0049bbf8 R08: 0000000000000000 R09: ffffffffc05b39d0
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: 0000000000000000 R14: ffffffffc05b39d0 R15: ffffaa9c0049bc70
FS:  0000000000000000(0000) GS:ffff8be73fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 0000000075f0e000 CR4: 00000000000006f0

Fixes: ee9b749cb9ad ("Bluetooth: btintel: Iterate only bluetooth device ACPI entries")
Signed-off-by: Kiran K <[e-mail]>
---
 drivers/bluetooth/btintel.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

Comments

[e-mail] March 8, 2023, 8:40 a.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=727769

---Test result---

Test Summary:
CheckPatch                    FAIL      1.09 seconds
GitLint                       FAIL      0.68 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      39.89 seconds
CheckAllWarning               PASS      43.61 seconds
CheckSparse                   PASS      48.66 seconds
CheckSmatch                   PASS      132.79 seconds
BuildKernel32                 PASS      37.94 seconds
TestRunnerSetup               PASS      553.43 seconds
TestRunner_l2cap-tester       PASS      18.92 seconds
TestRunner_iso-tester         PASS      21.80 seconds
TestRunner_bnep-tester        PASS      6.97 seconds
TestRunner_mgmt-tester        PASS      132.20 seconds
TestRunner_rfcomm-tester      PASS      10.79 seconds
TestRunner_sco-tester         PASS      9.90 seconds
TestRunner_ioctl-tester       PASS      12.01 seconds
TestRunner_mesh-tester        PASS      8.58 seconds
TestRunner_smp-tester         PASS      9.87 seconds
TestRunner_userchan-tester    PASS      7.17 seconds
IncrementalBuild              PASS      35.82 seconds

Details
##############################
Test: CheckPatch - FAIL
Desc: Run checkpatch.pl script
Output:
[v1] Bluetooth: btinel: Check ACPI handle for NULL before accessing
WARNING: Possible repeated word: 'Simics'
#77: 
Hardware name: Simics Simics, BIOS Simics 01/01/2011

total: 0 errors, 1 warnings, 27 lines checked

NOTE: For some of the reported defects, checkpatch may be able to
      mechanically convert to the typical style using --fix or --fix-inplace.

/github/workspace/src/src/13165350.patch has style problems, please review.

NOTE: Ignored message types: UNKNOWN_COMMIT_ID

NOTE: If any of the errors are false positives, please report
      them to the maintainer, see CHECKPATCH in MAINTAINERS.


##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
[v1] Bluetooth: btinel: Check ACPI handle for NULL before accessing

WARNING: I3 - ignore-body-lines: gitlint will be switching from using Python regex 'match' (match beginning) to 'search' (match anywhere) semantics. Please review your ignore-body-lines.regex option accordingly. To remove this warning, set general.regex-style-search=True. More details: https://jorisroovers.github.io/gitlint/configuration/#regex-style-search
13: B1 Line exceeds max length (381>80): "Modules linked in: bnep intel_powerclamp coretemp kvm_intel kvm irqbypass intel_cstate input_leds joydev serio_raw mac_hid btusb(OE) btintel(OE) bluetooth(OE) lpc_ich compat(OE) ecdh_generic i7core_edac i5500_temp shpchp binfmt_misc sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid e1000e psmouse ahci pata_acpi libahci ptp pps_core floppy"
14: B1 Line exceeds max length (91>80): "CPU: 0 PID: 35 Comm: kworker/u3:0 Tainted: G           OE    4.15.0-140-generic #144-Ubuntu"


---
Regards,
Linux Bluetooth

[e-mail] March 10, 2023, 12:20 a.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Wed,  8 Mar 2023 13:28:37 +0530 you wrote:
> Older platforms and Virtual platforms which doesn't have support for
> bluetooth device in ACPI firmware will not have valid ACPI handle. Check
> for validity of handle before accessing.
> 
> dmesg log from simics environment (virtual platform):
> 
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
> IP: acpi_ns_walk_namespace+0x5c/0x278
> PGD 0 P4D 0
> Oops: 0000 [#1] SMP PTI
> Modules linked in: bnep intel_powerclamp coretemp kvm_intel kvm irqbypass intel_cstate input_leds joydev serio_raw mac_hid btusb(OE) btintel(OE) bluetooth(OE) lpc_ich compat(OE) ecdh_generic i7core_edac i5500_temp shpchp binfmt_misc sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid hid e1000e psmouse ahci pata_acpi libahci ptp pps_core floppy
> CPU: 0 PID: 35 Comm: kworker/u3:0 Tainted: G           OE    4.15.0-140-generic #144-Ubuntu
> Hardware name: Simics Simics, BIOS Simics 01/01/2011
> Workqueue: hci0 hci_power_on [bluetooth]
> RIP: 0010:acpi_ns_walk_namespace+0x5c/0x278
> RSP: 0000:ffffaa9c0049bba8 EFLAGS: 00010246
> RAX: 0000000000000001 RBX: 0000000000001001 RCX: 0000000000000010
> RDX: ffffffff92ea7e27 RSI: ffffffff92ea7e10 RDI: 00000000000000c8
> RBP: ffffaa9c0049bbf8 R08: 0000000000000000 R09: ffffffffc05b39d0
> R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
> R13: 0000000000000000 R14: ffffffffc05b39d0 R15: ffffaa9c0049bc70
> FS:  0000000000000000(0000) GS:ffff8be73fc00000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000018 CR3: 0000000075f0e000 CR4: 00000000000006f0
> 
> [...]

Here is the summary with links:
  - [v1] Bluetooth: btinel: Check ACPI handle for NULL before accessing
    https://git.kernel.org/bluetooth/bluetooth-next/c/44f771148fb8

You are awesome, thank you!

Patch

diff --git a/drivers/bluetooth/btintel.c b/drivers/bluetooth/btintel.c
index e8d4b59e89c5..af774688f1c0 100644
--- a/drivers/bluetooth/btintel.c
+++ b/drivers/bluetooth/btintel.c
@@ -2326,6 +2326,7 @@  static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver
 	struct btintel_ppag ppag;
 	struct sk_buff *skb;
 	struct btintel_loc_aware_reg ppag_cmd;
+	acpi_handle handle;
 
 	/* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */
 	switch (ver->cnvr_top & 0xFFF) {
@@ -2335,12 +2336,18 @@  static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver
 		return;
 	}
 
+	handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev));
+	if (!handle) {
+		bt_dev_info(hdev, "No support for BT device in ACPI firmware");
+		return;
+	}
+
 	memset(&ppag, 0, sizeof(ppag));
 
 	ppag.hdev = hdev;
 	ppag.status = AE_NOT_FOUND;
-	acpi_walk_namespace(ACPI_TYPE_PACKAGE, ACPI_HANDLE(GET_HCIDEV_DEV(hdev)),
-			    1, NULL, btintel_ppag_callback, &ppag, NULL);
+	acpi_walk_namespace(ACPI_TYPE_PACKAGE, handle, 1, NULL,
+			    btintel_ppag_callback, &ppag, NULL);
 
 	if (ACPI_FAILURE(ppag.status)) {
 		if (ppag.status == AE_NOT_FOUND) {