Bluetooth: hci_ldisc: require CAP_NET_ADMIN to attach N_HCI ldisc

[mirror_ubuntu-focal-kernel.git] / drivers / bluetooth / hci_ldisc.c

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 85a30fb9177bbe719666d9e00f63e219f3ef3f49..51d1260e78c83e33affe6b4074bcd41edba91c36 100644 (file)
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -127,10 +127,9 @@ int hci_uart_tx_wakeup(struct hci_uart *hu)
        if (!test_bit(HCI_UART_PROTO_READY, &hu->flags))
                goto no_schedule;
 
-       if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) {
-               set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+       set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+       if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state))
                goto no_schedule;
-       }
 
        BT_DBG("");
 
@@ -174,10 +173,10 @@ restart:
                kfree_skb(skb);
        }
 
+       clear_bit(HCI_UART_SENDING, &hu->tx_state);
        if (test_bit(HCI_UART_TX_WAKEUP, &hu->tx_state))
                goto restart;
 
-       clear_bit(HCI_UART_SENDING, &hu->tx_state);
        wake_up_bit(&hu->tx_state, HCI_UART_SENDING);
 }
 
@@ -480,6 +479,9 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
        BT_DBG("tty %p", tty);
 
+       if (!capable(CAP_NET_ADMIN))
+               return -EPERM;
+
        /* Error if the tty has no write op instead of leaving an exploitable
         * hole
         */
@@ -538,6 +540,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
                clear_bit(HCI_UART_PROTO_READY, &hu->flags);
                percpu_up_write(&hu->proto_lock);
 
+               cancel_work_sync(&hu->init_ready);
                cancel_work_sync(&hu->write_work);
 
                if (hdev) {