* [PATCH net] Bluetooth: Fix potential null pointer dereference in create_le_conn_complete
@ 2020-11-13 11:39 Wang Hai
2020-11-23 11:58 ` Marcel Holtmann
0 siblings, 1 reply; 2+ messages in thread
From: Wang Hai @ 2020-11-13 11:39 UTC (permalink / raw)
To: davem, kuba, marcel, johan.hedberg, jpawlowski
Cc: linux-bluetooth, netdev, linux-kernel
The pointer 'conn' may be null. Before being used by
hci_connect_le_scan_cleanup(), The pointer 'conn' must be
checked whether it is null.
Fixes: 28a667c9c279 ("Bluetooth: advertisement handling in new connect procedure")
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
---
net/bluetooth/hci_conn.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index d0c1024bf600..6ca402c90ee1 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -757,6 +757,8 @@ static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
hci_dev_lock(hdev);
conn = hci_lookup_le_connect(hdev);
+ if (!conn)
+ goto done;
if (!status) {
hci_connect_le_scan_cleanup(conn);
@@ -766,9 +768,6 @@ static void create_le_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
bt_dev_err(hdev, "request failed to create LE connection: "
"status 0x%2.2x", status);
- if (!conn)
- goto done;
-
hci_le_conn_failed(conn, status);
done:
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] Bluetooth: Fix potential null pointer dereference in create_le_conn_complete
2020-11-13 11:39 [PATCH net] Bluetooth: Fix potential null pointer dereference in create_le_conn_complete Wang Hai
@ 2020-11-23 11:58 ` Marcel Holtmann
0 siblings, 0 replies; 2+ messages in thread
From: Marcel Holtmann @ 2020-11-23 11:58 UTC (permalink / raw)
To: Wang Hai
Cc: David S. Miller, kuba, Johan Hedberg, jpawlowski,
linux-bluetooth, netdev, linux-kernel
Hi Wang,
> The pointer 'conn' may be null. Before being used by
> hci_connect_le_scan_cleanup(), The pointer 'conn' must be
> checked whether it is null.
>
> Fixes: 28a667c9c279 ("Bluetooth: advertisement handling in new connect procedure")
> Reported-by: Hulk Robot <hulkci@huawei.com>
> Signed-off-by: Wang Hai <wanghai38@huawei.com>
> ---
> net/bluetooth/hci_conn.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
please send a version that applies cleanly against bluetooth-next tree.
Regards
Marcel
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-11-23 11:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-13 11:39 [PATCH net] Bluetooth: Fix potential null pointer dereference in create_le_conn_complete Wang Hai
2020-11-23 11:58 ` Marcel Holtmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).