diff options
| author | Soenke Huster <[email protected]> | 2022-07-22 11:53:07 +0000 |
|---|---|---|
| committer | Luiz Augusto von Dentz <[email protected]> | 2022-08-09 00:04:37 +0000 |
| commit | ce78e557ff8819f2d10e8d6bae79404bfbbd6809 (patch) | |
| tree | f67b73208d3cdb95f0fa3a75bc473f900038176c /net/bluetooth/aosp.c | |
| parent | Bluetooth: ISO: Fix info leak in iso_sock_getsockopt() (diff) | |
| download | kernel-ce78e557ff8819f2d10e8d6bae79404bfbbd6809.tar.gz kernel-ce78e557ff8819f2d10e8d6bae79404bfbbd6809.zip | |
Bluetooth: Fix null pointer deref on unexpected status event
__hci_cmd_sync returns NULL if the controller responds with a status
event. This is unexpected for the commands sent here, but on
occurrence leads to null pointer dereferences and thus must be
handled.
Signed-off-by: Soenke Huster <[email protected]>
Signed-off-by: Luiz Augusto von Dentz <[email protected]>
Diffstat (limited to 'net/bluetooth/aosp.c')
| -rw-r--r-- | net/bluetooth/aosp.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/net/bluetooth/aosp.c b/net/bluetooth/aosp.c index 432ae3aac9e3..1d67836e95e1 100644 --- a/net/bluetooth/aosp.c +++ b/net/bluetooth/aosp.c @@ -54,7 +54,10 @@ void aosp_do_open(struct hci_dev *hdev) /* LE Get Vendor Capabilities Command */ skb = __hci_cmd_sync(hdev, hci_opcode_pack(0x3f, 0x153), 0, NULL, HCI_CMD_TIMEOUT); - if (IS_ERR(skb)) { + if (IS_ERR_OR_NULL(skb)) { + if (!skb) + skb = ERR_PTR(-EIO); + bt_dev_err(hdev, "AOSP get vendor capabilities (%ld)", PTR_ERR(skb)); return; @@ -152,7 +155,10 @@ static int enable_quality_report(struct hci_dev *hdev) skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp, HCI_CMD_TIMEOUT); - if (IS_ERR(skb)) { + if (IS_ERR_OR_NULL(skb)) { + if (!skb) + skb = ERR_PTR(-EIO); + bt_dev_err(hdev, "Enabling Android BQR failed (%ld)", PTR_ERR(skb)); return PTR_ERR(skb); @@ -171,7 +177,10 @@ static int disable_quality_report(struct hci_dev *hdev) skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp, HCI_CMD_TIMEOUT); - if (IS_ERR(skb)) { + if (IS_ERR_OR_NULL(skb)) { + if (!skb) + skb = ERR_PTR(-EIO); + bt_dev_err(hdev, "Disabling Android BQR failed (%ld)", PTR_ERR(skb)); return PTR_ERR(skb); |