From: Andrei Emeltchenko <Andrei.Emeltchenko.news@gmail.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH 4/8] Bluetooth: smp: Fix possible NULL dereference
Date: Thu, 19 Jul 2012 17:03:43 +0300 [thread overview]
Message-ID: <1342706627-19129-5-git-send-email-Andrei.Emeltchenko.news@gmail.com> (raw)
In-Reply-To: <1342706627-19129-1-git-send-email-Andrei.Emeltchenko.news@gmail.com>
From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
smp_chan_create might return NULL so we need to check before
dereferencing smp.
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
---
net/bluetooth/smp.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 5bb5b51..1104c5a 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -578,8 +578,11 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
smp = smp_chan_create(conn);
+ else
+ smp = conn->smp_chan;
- smp = conn->smp_chan;
+ if (!smp)
+ return SMP_UNSPECIFIED;
smp->preq[0] = SMP_CMD_PAIRING_REQ;
memcpy(&smp->preq[1], req, sizeof(*req));
--
1.7.9.5
next prev parent reply other threads:[~2012-07-19 14:03 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-07-19 14:03 [PATCH 0/8] Bluetooth patches Andrei Emeltchenko
2012-07-19 14:03 ` [PATCH 1/8] Bluetooth: mgmt: Managing only BR/EDR HCI controllers Andrei Emeltchenko
2012-07-19 14:03 ` [PATCH 2/8] Bluetooth: debug: Fix printing A2MP cmd code format Andrei Emeltchenko
2012-07-19 14:03 ` [PATCH 3/8] Bluetooth: debug: Fix printing refcnt for hci_conn Andrei Emeltchenko
2012-07-19 14:03 ` Andrei Emeltchenko [this message]
2012-07-19 14:03 ` [PATCH 5/8] Bluetooth: trivial: Fix mixing spaces and tabs in smp Andrei Emeltchenko
2012-07-19 14:03 ` [PATCH 6/8] Bluetooth: Define AMP controller statuses Andrei Emeltchenko
2012-07-19 14:03 ` [PATCH 7/8] Bluetooth: Do not shadow hdr variable Andrei Emeltchenko
2012-07-19 14:03 ` [PATCH 8/8] Bluetooth: Fix processing A2MP chan in security_cfm Andrei Emeltchenko
2012-07-19 16:21 ` Gustavo Padovan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1342706627-19129-5-git-send-email-Andrei.Emeltchenko.news@gmail.com \
--to=andrei.emeltchenko.news@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.