Received: by 2002:a05:6a10:a0d1:0:0:0:0 with SMTP id j17csp2747506pxa; Fri, 7 Aug 2020 21:16:09 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyQbkhiiwQDp7buNY+btI1Oe8OVA9S9a4oZUmXJdmkxZ5309sw7bjYRnCA0VWA/59bLuDMH X-Received: by 2002:a17:906:c1d8:: with SMTP id bw24mr12177890ejb.91.1596860169523; Fri, 07 Aug 2020 21:16:09 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1596860169; cv=none; d=google.com; s=arc-20160816; b=z5B73Hz44+RgqZZAddoZQd256Ek15M4XvkciaVjN4srl5AF7TsEp9qeeZuXwdOzc53 7UKAAb4nWTbH98c8wipRwUjJZmineowWC60Yk/eWPRO97zmhbMLgtmDS51aT5VoE2CrX etyHeK10RJSVxcCpbsfXvoEf5rbRGMPo0QovAeNLoG30o5+5il7e+a5rHECQ8SVoUITc SETLOIolRRPMBSvJI9u39fMpL3kVnCRNtkzFvwaGkKOCc213Jfn/hzKVJYN5o+SydoDB AmRBz/ea6XQLcWEpXaHW0EInEIMoxjUbzV18pLnwjau0PWkNTRa9l+PhImEog1GnvZGk aoJQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=eBX2STd6CRBk1vKmSlEBQtLB8UUMASbhavMeJ1WJR0A=; b=E/x0hOPZxgCWu2EgjOA2+kLJPSqlYOmrniLBWS3sMCZ0bSBBHXND1EhdoJK1QX9rK6 Es6i6sxXjqstUAXmoZqbFZSDFXaTmNO+n8zVOF5O2hfiPrRjBcz2XjZzZr2l9mEHBMIA xKqhU1zk7pRXnqcAUx/qG5ThVXGwd1upPuiJBOFNxrQn25ORz9yp5V+fZ44FG8jK1QBu 66hqveoAG2nQFRvqEhFSh5P7gmwrKxzm/UTTDBCbIiJhH8/3TZ7h2irbG/w8wU+JORtg 1y4b0GCACxQVez9yjPsIApBitzyMN3pVhqUAADuOPsG17brXmWxbP2+Gs5nEq2JGsoBl KPzw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=ImMnrn3Z; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id i13si6508653ejv.279.2020.08.07.21.15.33; Fri, 07 Aug 2020 21:16:09 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=ImMnrn3Z; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726053AbgHHEGn (ORCPT + 99 others); Sat, 8 Aug 2020 00:06:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57726 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725267AbgHHEGm (ORCPT ); Sat, 8 Aug 2020 00:06:42 -0400 Received: from mail-qk1-x743.google.com (mail-qk1-x743.google.com [IPv6:2607:f8b0:4864:20::743]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E736C061756; Fri, 7 Aug 2020 21:06:42 -0700 (PDT) Received: by mail-qk1-x743.google.com with SMTP id p4so3635899qkf.0; Fri, 07 Aug 2020 21:06:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=eBX2STd6CRBk1vKmSlEBQtLB8UUMASbhavMeJ1WJR0A=; b=ImMnrn3Z4k3xH3d5wjuGGYN5dCY5Wg7yTR6mWwxE/0/bqZN2eh0ux/M635crPwEWDO RUqUkjgZ166oTo3IMuMmnuMHsSMhkDzoRms1MNwfTUorcMFXA6UACHWMaal1MUaCARlN RUqIlF2x87k23WZtrRs2/GqwsDiG1blYKkLittDuyJQzNHsFAhC5NfgMSB0kFmP2VIYD 2X3iQoriLLXUSbdBDPmnR2S8YGDLWYyiyAjU6JfeQLkoIAcUMa/itMhvlGFDVDWyx3bU osogjoRLH9tdNW8lQiZdZcy9WzfK4K3DIN248WTy1sj5QRBgygAtyaU6lmCPxULnuLC6 DqYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=eBX2STd6CRBk1vKmSlEBQtLB8UUMASbhavMeJ1WJR0A=; b=X8F/7+R/+iOLZpWCkoZZGiEWtCqKhrLp07JmhlwRAMhMeiKzwtceA9z1bxXNv6OUCD cY4M1/wG3Ji18qN2IyUlmTI9Qs9DaVgI5f1HlE0cdYvfddV5B66z0LLXpguJXMHGyRjR fSn6heNYswsJZ8gqsc9nv7g0OoDAKIhsCudvqdxRL8DsYG4JlxOMoO7AoRWIcIhyZv20 C83m2htx14OUIYLS2hsn37pQRocNvw+aP7/jKOIbooj2gJUGQYofZYVIX4UlZRD7J6YM R416hKME0SNhHzWGqtXZsU1vAhV1kHvkx9fMPScmuhsE4rhClvXxFXPNY3rg6yQV/ded pVHg== X-Gm-Message-State: AOAM533KCDOXIwgVQnuVm7h/kpwsqVHLrPNJ4K0R9w6UdrwadWG4Z0Jn bDE3XyX9MYIC5ZvyPztVPw== X-Received: by 2002:a37:a503:: with SMTP id o3mr16204813qke.162.1596859601722; Fri, 07 Aug 2020 21:06:41 -0700 (PDT) Received: from localhost.localdomain (146-115-88-66.s3894.c3-0.sbo-ubr1.sbo.ma.cable.rcncustomer.com. [146.115.88.66]) by smtp.gmail.com with ESMTPSA id i7sm9264630qtb.27.2020.08.07.21.06.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 07 Aug 2020 21:06:41 -0700 (PDT) From: Peilin Ye To: Marcel Holtmann , Johan Hedberg Cc: Peilin Ye , Andrei Emeltchenko , Greg Kroah-Hartman , "David S. Miller" , Jakub Kicinski , linux-kernel-mentees@lists.linuxfoundation.org, syzkaller-bugs@googlegroups.com, linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [Linux-kernel-mentees] [PATCH net] Bluetooth: Fix NULL pointer dereference in amp_read_loc_assoc_final_data() Date: Sat, 8 Aug 2020 00:04:40 -0400 Message-Id: <20200808040440.255578-1-yepeilin.cs@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Prevent amp_read_loc_assoc_final_data() from dereferencing `mgr` as NULL. Reported-and-tested-by: syzbot+f4fb0eaafdb51c32a153@syzkaller.appspotmail.com Fixes: 9495b2ee757f ("Bluetooth: AMP: Process Chan Selected event") Signed-off-by: Peilin Ye --- net/bluetooth/amp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c index 9c711f0dfae3..be2d469d6369 100644 --- a/net/bluetooth/amp.c +++ b/net/bluetooth/amp.c @@ -297,6 +297,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev, struct hci_request req; int err; + if (!mgr) + return; + cp.phy_handle = hcon->handle; cp.len_so_far = cpu_to_le16(0); cp.max_len = cpu_to_le16(hdev->amp_assoc_size); -- 2.25.1