Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-5280-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Date: Wed, 12 Jun 2024 15:37:14 +0300
From: Dan Carpenter <dan.carpenter@linaro.org>
To: Iulia Tanasescu <iulia.tanasescu@nxp.com>
Cc: linux-bluetooth@vger.kernel.org
Subject: [bug report] Bluetooth: ISO: Use defer setup to separate PA sync and
 BIG sync
Message-ID: <1fe76229-9b40-400d-9d63-03a025603bdf@moroto.mountain>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hello Iulia Tanasescu,

Commit fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA
sync and BIG sync") from Aug 17, 2023 (linux-next), leads to the
following Smatch static checker warning:

	net/bluetooth/iso.c:1364 iso_sock_recvmsg()
	error: we previously assumed 'pi->conn->hcon' could be null (see line 1359)

net/bluetooth/iso.c
    1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,
    1348                             size_t len, int flags)
    1349 {
    1350         struct sock *sk = sock->sk;
    1351         struct iso_pinfo *pi = iso_pi(sk);
    1352 
    1353         BT_DBG("sk %p", sk);
    1354 
    1355         if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
    1356                 lock_sock(sk);
    1357                 switch (sk->sk_state) {
    1358                 case BT_CONNECT2:
    1359                         if (pi->conn->hcon &&
                                     ^^^^^^^^^^^^^^
If ->hcon is NULL

    1360                             test_bit(HCI_CONN_PA_SYNC, &pi->conn->hcon->flags)) {
    1361                                 iso_conn_big_sync(sk);
    1362                                 sk->sk_state = BT_LISTEN;
    1363                         } else {
--> 1364                                 iso_conn_defer_accept(pi->conn->hcon);
                                                               ^^^^^^^^^^^^^^
then we're toast

    1365                                 sk->sk_state = BT_CONFIG;
    1366                         }
    1367                         release_sock(sk);
    1368                         return 0;
    1369                 case BT_CONNECTED:
    1370                         if (test_bit(BT_SK_PA_SYNC, &iso_pi(sk)->flags)) {

regards,
dan carpenter