diff options
| author |   Andrei Emeltchenko <andrei.emeltchenko@intel.com> | 2012-09-28 14:28:50 +0300 |
|---|---|---|
| committer |   Gustavo Padovan <gustavo.padovan@collabora.co.uk> | 2012-10-01 12:02:12 -0300 |
| commit | bc8dce4f7b4908bac69acac34d19b4234ba19cee (patch) | |
| tree | 2dda8509eb59e2f216a0a51087e2a8d1b0a87e2c /net/bluetooth/a2mp.c | |
| parent | Bluetooth: btmrvl: Fix skb buffer overflow (diff) | |
| download | linux-dev-bc8dce4f7b4908bac69acac34d19b4234ba19cee.tar.xz linux-dev-bc8dce4f7b4908bac69acac34d19b4234ba19cee.zip | |
Bluetooth: A2MP: Fix potential NULL dereference
Return INVALID_CTRL_ID for unknown AMP controller and for BR/EDR
controller and fixes dereference possible NULL pointer.
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Diffstat (limited to 'net/bluetooth/a2mp.c')
| -rw-r--r-- | net/bluetooth/a2mp.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c index 42788cdbb4fe..d4946b591b71 100644 --- a/net/bluetooth/a2mp.c +++ b/net/bluetooth/a2mp.c @@ -278,7 +278,7 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, BT_DBG("id %d", req->id); hdev = hci_dev_get(req->id); - if (!hdev) { + if (!hdev || hdev->dev_type != HCI_AMP) { struct a2mp_info_rsp rsp; rsp.id = req->id; @@ -286,14 +286,16 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb, a2mp_send(mgr, A2MP_GETINFO_RSP, hdr->ident, sizeof(rsp), &rsp); - } - if (hdev->dev_type != HCI_BREDR) { - mgr->state = READ_LOC_AMP_INFO; - hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL); + goto done; } - hci_dev_put(hdev); + mgr->state = READ_LOC_AMP_INFO; + hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL); + +done: + if (hdev) + hci_dev_put(hdev); skb_pull(skb, sizeof(*req)); return 0; |