From: Waldemar Rymarkiewicz Date: Fri, 23 Sep 2011 08:01:30 +0000 (+0200) Subject: Bluetooth: Fix possible NULL pointer dereference X-Git-Tag: MMI-PSA29.97-13-9~18194^2~83^2~120^2~2 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b6f98044a6cbeba8234a3d433d715e9ef36880c4;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git Bluetooth: Fix possible NULL pointer dereference Checking conn->pending_sec_level if there is no connection leads to potential null pointer dereference. Don't process pin_code_request_event at all if no connection exists. Signed-off-by: Waldemar Rymarkiewicz Acked-by: Marcel Holtmann Signed-off-by: Gustavo F. Padovan --- diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 35083f2aa2ea..7390ba9d4f6e 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2174,7 +2174,10 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff hci_dev_lock(hdev); conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); - if (conn && conn->state == BT_CONNECTED) { + if (!conn) + goto unlock; + + if (conn->state == BT_CONNECTED) { hci_conn_hold(conn); conn->disc_timeout = HCI_PAIRING_TIMEOUT; hci_conn_put(conn); @@ -2194,6 +2197,7 @@ static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure); } +unlock: hci_dev_unlock(hdev); }