Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
[ Upstream commit 3afee21181
]
This event is just specified for SCO and eSCO link types.
On the reception of a HCI_Synchronous_Connection_Complete for a BDADDR
of an existing LE connection, LE link type and a status that triggers the
second case of the packet processing a NULL pointer dereference happens,
as conn->link is NULL.
Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
cbd96d6cad
commit
f61c23e73d
|
@ -4661,6 +4661,19 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
|
|||
struct hci_ev_sync_conn_complete *ev = data;
|
||||
struct hci_conn *conn;
|
||||
|
||||
switch (ev->link_type) {
|
||||
case SCO_LINK:
|
||||
case ESCO_LINK:
|
||||
break;
|
||||
default:
|
||||
/* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
|
||||
* for HCI_Synchronous_Connection_Complete is limited to
|
||||
* either SCO or eSCO
|
||||
*/
|
||||
bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
|
||||
return;
|
||||
}
|
||||
|
||||
bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
|
||||
|
||||
hci_dev_lock(hdev);
|
||||
|
|
Loading…
Reference in New Issue