Commit 9e2e944b authored by Soenke Huster's avatar Soenke Huster Committed by sanglipeng
Browse files

Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt 

stable inclusion
from stable-v5.10.167
commit 0f9db1209f59844839175b5b907d3778cafde93d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7TH9O

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0f9db1209f59844839175b5b907d3778cafde93d



--------------------------------

commit 3afee211 upstream.

This event is just specified for SCO and eSCO link types.
On the reception of a HCI_Synchronous_Connection_Complete for a BDADDR
of an existing LE connection, LE link type and a status that triggers the
second case of the packet processing a NULL pointer dereference happens,
as conn->link is NULL.

Signed-off-by: default avatarSoenke Huster <soenke.huster@eknoes.de>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: default avatarOvidiu Panait <ovidiu.panait@eng.windriver.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 8b10fd62

net/bluetooth/hci_event.c

+13 −0
Original line number Diff line number Diff line
@@ -4307,6 +4307,19 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, 
	struct hci_ev_sync_conn_complete *ev = (void *) skb->data;

	struct hci_conn *conn;



	switch (ev->link_type) {

	case SCO_LINK:

	case ESCO_LINK:

		break;

	default:

		/* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type

		 * for HCI_Synchronous_Connection_Complete is limited to

		 * either SCO or eSCO

		 */

		bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");

		return;

	}



	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);



	hci_dev_lock(hdev);