Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Siddh Raman Pant <code@siddh.me>
To:     Marcel Holtmann <marcel@holtmann.org>,
        Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Cc:     linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        syzbot+37acd5d80d00d609d233@syzkaller.appspotmail.com
Message-ID: <20230711131353.40500-1-code@siddh.me>
Subject: [PATCH] Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link
Date:   Tue, 11 Jul 2023 18:43:53 +0530
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=utf8
Precedence: bulk

hci_connect_sco currently returns NULL when there is no link (i.e. when
hci_conn_link() returns NULL).

sco_connect() expects an ERR_PTR in case of any error (see line 266 in
sco.c). Thus, hcon set as NULL passes through to sco_conn_add(), which
tries to get hcon->hdev, resulting in dereferencing a NULL pointer as
reported by syzkaller.

The same issue exists for iso_connect_cis() calling hci_connect_cis().

Thus, make hci_connect_sco() and hci_connect_cis() return ERR_PTR
instead of NULL.

Reported-and-tested-by: syzbot+37acd5d80d00d609d233@syzkaller.appspotmail.c=
om
Closes: https://syzkaller.appspot.com/bug?extid=3D37acd5d80d00d609d233
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple=
 hcon")
Signed-off-by: Siddh Raman Pant <code@siddh.me>
---
 net/bluetooth/hci_conn.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 056f9516e46d..21176908069d 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1684,7 +1684,7 @@ struct hci_conn *hci_connect_sco(struct hci_dev *hdev=
, int type, bdaddr_t *dst,
 =09if (!link) {
 =09=09hci_conn_drop(acl);
 =09=09hci_conn_drop(sco);
-=09=09return NULL;
+=09=09return ERR_PTR(-ENOLINK);
 =09}
=20
 =09sco->setting =3D setting;
@@ -2254,7 +2254,7 @@ struct hci_conn *hci_connect_cis(struct hci_dev *hdev=
, bdaddr_t *dst,
 =09if (!link) {
 =09=09hci_conn_drop(le);
 =09=09hci_conn_drop(cis);
-=09=09return NULL;
+=09=09return ERR_PTR(-ENOLINK);
 =09}
=20
 =09/* If LE is already connected and CIS handle is already set proceed to
--=20
2.40.1