diff options
| author | Marcel Holtmann <marcel@holtmann.org> | 2007-05-09 11:15:40 +0400 |
|---|---|---|
| committer | David S. Miller <davem@sunset.davemloft.net> | 2007-05-11 10:45:05 +0400 |
| commit | 22ad42033b7d2b3d7928fba9f89d1c7f8a3c9581 (patch) | |
| tree | e07c8da23cb753237effd987f9d31643ec50c65e /drivers/bluetooth | |
| parent | d215874460e7657b8e104de024140e0932690450 (diff) | |
| download | linux-22ad42033b7d2b3d7928fba9f89d1c7f8a3c9581.tar.xz | |
[Bluetooth] Fix NULL pointer dereference in HCI line discipline
Normally a serial Bluetooth device is opened, TIOSETD'ed to N_HCI line
discipline, HCIUARTSETPROTO'ed and finally closed. In case the device
fails to HCIUARTSETPROTO, closing it produces a NULL pointer dereference.
Signed-off-by: Ohad Ben-Cohen <ohad@bencohen.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers/bluetooth')
| -rw-r--r-- | drivers/bluetooth/hci_ldisc.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index 75c15085f81f..e8ae0d7e7716 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -307,7 +307,9 @@ static void hci_uart_tty_close(struct tty_struct *tty) if (hu) { struct hci_dev *hdev = hu->hdev; - hci_uart_close(hdev); + + if (hdev) + hci_uart_close(hdev); if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) { hu->proto->close(hu); |