Update compat-wireless to 2.6.36-5-spn

chromeos/compat-wireless/drivers/bluetooth/hci_ldisc.c

 /*
  *
  *  Bluetooth HCI UART driver
  *
  *  Copyright (C) 2000-2001  Qualcomm Incorporated
  *  Copyright (C) 2002-2003  Maxim Krasnyansky <maxk@qualcomm.com>
  *  Copyright (C) 2004-2005  Marcel Holtmann <marcel@holtmann.org>
  *
  *
  *  This program is free software; you can redistribute it and/or modify
@@ skipping 238 matching lines @@
  *     tty    pointer to tty info structure
  * Return Value:    
  *     0 if success, otherwise error code
  */
 static int hci_uart_tty_open(struct tty_struct *tty)
 {
         struct hci_uart *hu = (void *) tty->disc_data;
 
         BT_DBG("tty %p", tty);
 
+        /* FIXME: This btw is bogus, nothing requires the old ldisc to clear
+           the pointer */
         if (hu)
                 return -EEXIST;
 
+        /* Error if the tty has no write op instead of leaving an exploitable
+           hole */
+        if (tty->ops->write == NULL)
+                return -EOPNOTSUPP;
+
         if (!(hu = kzalloc(sizeof(struct hci_uart), GFP_KERNEL))) {
                 BT_ERR("Can't allocate control structure");
                 return -ENFILE;
         }
 
         tty->disc_data = hu;
         hu->tty = tty;
         tty->receive_room = 65536;
 
         spin_lock_init(&hu->rx_lock);
@@ skipping 322 matching lines @@
 module_exit(hci_uart_exit);
 
 module_param(reset, bool, 0644);
 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
 
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth HCI UART driver ver " VERSION);
 MODULE_VERSION(VERSION);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_LDISC(N_HCI);