1 files changed, 13 insertions, 3 deletions

diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 998833d93c13..48ad2a7ab080 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -101,7 +101,7 @@ static inline void hci_uart_tx_complete(struct hci_uart *hu, int pkt_type)
                 break;
 
         case HCI_SCODATA_PKT:
-                hdev->stat.cmd_tx++;
+                hdev->stat.sco_tx++;
                 break;
         }
 }
@@ -256,9 +256,16 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 
         BT_DBG("tty %p", tty);
 
+        /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
+           the pointer */
         if (hu)
                 return -EEXIST;
 
+        /* Error if the tty has no write op instead of leaving an exploitable
+           hole */
+        if (tty->ops->write == NULL)
+                return -EOPNOTSUPP;
+
         if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
                 BT_ERR("Can't allocate control structure");
                 return -ENFILE;
@@ -304,8 +311,10 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 
                 if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
                         hu->proto->close(hu);
-                        hci_unregister_dev(hdev);
-                        hci_free_dev(hdev);
+                        if (hdev) {
+                                hci_unregister_dev(hdev);
+                                hci_free_dev(hdev);
+                        }
                 }
         }
 }
@@ -389,6 +398,7 @@ static int hci_uart_register_dev(struct hci_uart *hu)
         hdev->flush = hci_uart_flush;
         hdev->send  = hci_uart_send_frame;
         hdev->destruct = hci_uart_destruct;
+        hdev->parent = hu->tty->dev;
 
         hdev->owner = THIS_MODULE;