Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754491AbdHDXbc (ORCPT ); Fri, 4 Aug 2017 19:31:32 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:49818 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753635AbdHDX2l (ORCPT ); Fri, 4 Aug 2017 19:28:41 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Patrik Flykt , Johan Hedberg , Marcel Holtmann Subject: [PATCH 3.18 13/50] Bluetooth: Fix potential NULL dereference Date: Fri, 4 Aug 2017 16:15:59 -0700 Message-Id: <20170804231551.603280336@linuxfoundation.org> X-Mailer: git-send-email 2.13.4 In-Reply-To: <20170804231550.830518786@linuxfoundation.org> References: <20170804231550.830518786@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1311 Lines: 42 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hedberg commit 88d9077c27d0c1a7c022d9dc987640beecf23560 upstream. The bnep_get_device function may be triggered by an ioctl just after a connection has gone down. In such a case the respective L2CAP chan->conn pointer will get set to NULL (by l2cap_chan_del). This patch adds a missing NULL check for this case in the bnep_get_device() function. Reported-by: Patrik Flykt Signed-off-by: Johan Hedberg Signed-off-by: Marcel Holtmann Signed-off-by: Greg Kroah-Hartman --- net/bluetooth/bnep/core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) --- a/net/bluetooth/bnep/core.c +++ b/net/bluetooth/bnep/core.c @@ -511,13 +511,12 @@ static int bnep_session(void *arg) static struct device *bnep_get_device(struct bnep_session *session) { - struct hci_conn *conn; + struct l2cap_conn *conn = l2cap_pi(session->sock->sk)->chan->conn; - conn = l2cap_pi(session->sock->sk)->chan->conn->hcon; - if (!conn) + if (!conn || !conn->hcon) return NULL; - return &conn->dev; + return &conn->hcon->dev; } static struct device_type bnep_type = {