lkml.org 
[lkml]   [2020]   [Nov]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH net] Bluetooth: Fix potential null pointer dereference in create_le_conn_complete
Date
The pointer 'conn' may be null. Before being used by
hci_connect_le_scan_cleanup(), The pointer 'conn' must be
checked whether it is null.

Fixes: 28a667c9c279 ("Bluetooth: advertisement handling in new connect procedure")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
---
net/bluetooth/hci_conn.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d0c1024bf600..6ca402c90ee1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -757,6 +757,8 @@ static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
hci_dev_lock(hdev);

conn = hci_lookup_le_connect(hdev);
+ if (!conn)
+ goto done;

if (!status) {
hci_connect_le_scan_cleanup(conn);
@@ -766,9 +768,6 @@ static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
bt_dev_err(hdev, "request failed to create LE connection: "
"status 0x%2.2x", status);

- if (!conn)
- goto done;
-
hci_le_conn_failed(conn, status);

done:
--
2.17.1
\
 
 \ /
  Last update: 2020-11-13 13:21    [W:0.081 / U:0.308 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site