summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorRam Malovany <ramm@ti.com>2012-07-19 11:26:10 +0400
committerGustavo Padovan <gustavo.padovan@collabora.co.uk>2012-08-06 22:19:36 +0400
commit7cc8380eb10347016d95bf6f9d842c2ae6d12932 (patch)
tree26e46322ed9e86972c87b003b514afc1550d44c6
parentc810089c27e48b816181b454fcc493d19fdbc2ba (diff)
downloadlinux-7cc8380eb10347016d95bf6f9d842c2ae6d12932.tar.xz
Bluetooth: Fix using a NULL inquiry cache entry
If the device was not found in a list of found devices names of which are pending.This may happen in a case when HCI Remote Name Request was sent as a part of incoming connection establishment procedure. Hence there is no need to continue resolving a next name as it will be done upon receiving another Remote Name Request Complete Event. This will fix a kernel crash when trying to use this entry to resolve the next name. Cc: stable@vger.kernel.org Signed-off-by: Ram Malovany <ramm@ti.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
-rw-r--r--net/bluetooth/hci_event.c16
1 files changed, 11 insertions, 5 deletions
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index b64cfa213bd6..fe9a3d6d30b0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -1396,12 +1396,18 @@ static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
return;
e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
- if (e) {
+ /* If the device was not found in a list of found devices names of which
+ * are pending. there is no need to continue resolving a next name as it
+ * will be done upon receiving another Remote Name Request Complete
+ * Event */
+ if (!e)
+ return;
+
+ list_del(&e->list);
+ if (name) {
e->name_state = NAME_KNOWN;
- list_del(&e->list);
- if (name)
- mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
- e->data.rssi, name, name_len);
+ mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
+ e->data.rssi, name, name_len);
}
if (hci_resolve_next_name(hdev))