lkml.org 
[lkml]   [2020]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] net: bluetooth: Fix null pointer dereference in hci_event_packet()
    On Thu, Oct 01, 2020 at 09:06:42AM +0200, Marcel Holtmann wrote:
    > Hi Anmol,
    >
    > > AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called from hci_event_packet() and there is a possibility, that hcon->amp_mgr may not be found when accessing after initialization of hcon.
    > >
    > > - net/bluetooth/hci_event.c:4945
    > > The bug seems to get triggered in this line:
    > >
    > > bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
    > >
    > > Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.
    > >
    > > Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt")
    > > Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
    > > Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
    > > Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
    > > ---
    > > Change in v3:
    > > - changed return o; to return; (Reported-by: kernel test robot <lkp@intel.com>
    > > )
    > >
    > > net/bluetooth/hci_event.c | 5 +++++
    > > 1 file changed, 5 insertions(+)
    >
    > patch has been applied to bluetooth-next tree.
    >
    > Regards
    >
    > Marcel
    >

    Thank you :)

    Best,
    Anmol

    \
     
     \ /
      Last update: 2020-10-01 09:47    [W:3.393 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site