2024-06-12 12:37:46

by Dan Carpenter

[permalink] [raw]
Subject: [bug report] Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync

Hello Iulia Tanasescu,

Commit fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA
sync and BIG sync") from Aug 17, 2023 (linux-next), leads to the
following Smatch static checker warning:

net/bluetooth/iso.c:1364 iso_sock_recvmsg()
error: we previously assumed 'pi->conn->hcon' could be null (see line 1359)

net/bluetooth/iso.c
1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1348 size_t len, int flags)
1349 {
1350 struct sock *sk = sock->sk;
1351 struct iso_pinfo *pi = iso_pi(sk);
1352
1353 BT_DBG("sk %p", sk);
1354
1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
1356 lock_sock(sk);
1357 switch (sk->sk_state) {
1358 case BT_CONNECT2:
1359 if (pi->conn->hcon &&
^^^^^^^^^^^^^^
If ->hcon is NULL

1360 test_bit(HCI_CONN_PA_SYNC, &pi->conn->hcon->flags)) {
1361 iso_conn_big_sync(sk);
1362 sk->sk_state = BT_LISTEN;
1363 } else {
--> 1364 iso_conn_defer_accept(pi->conn->hcon);
^^^^^^^^^^^^^^
then we're toast

1365 sk->sk_state = BT_CONFIG;
1366 }
1367 release_sock(sk);
1368 return 0;
1369 case BT_CONNECTED:
1370 if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {

regards,
dan carpenter