--- drivers/bluetooth/hci_ldisc.c

+++ drivers/bluetooth/hci_ldisc.c

@@ -258,9 +258,16 @@ static int hci_uart_tty_open(struct tty_

BT_DBG("tty %p", tty);

+ /* FIXME: This btw is bogus, nothing requires the old ldisc to clear

+ the pointer */

if (hu)

return -EEXIST;

+ /* Error if the tty has no write op instead of leaving an exploitable

+ hole */

+ if (tty->ops->write == NULL)

+ return -EOPNOTSUPP;

+

if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {

BT_ERR("Can't allocate control structure");

return -ENFILE;