diff options
| author | Siddh Raman Pant <code@siddh.me> | 2023-07-11 16:13:53 +0300 |
|---|---|---|
| committer | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2023-07-20 21:26:56 +0300 |
| commit | b4066eb04bb67e7ff66e5aaab0db4a753f37eaad (patch) | |
| tree | d61efcf01928bd39250474f280ea9b14be4795ad /drivers/fpga/fpga-mgr.c | |
| parent | de6dfcefd107667ce2dbedf4d9337f5ed557a4a1 (diff) | |
| download | linux-b4066eb04bb67e7ff66e5aaab0db4a753f37eaad.tar.xz | |
Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link
hci_connect_sco currently returns NULL when there is no link (i.e. when
hci_conn_link() returns NULL).
sco_connect() expects an ERR_PTR in case of any error (see line 266 in
sco.c). Thus, hcon set as NULL passes through to sco_conn_add(), which
tries to get hcon->hdev, resulting in dereferencing a NULL pointer as
reported by syzkaller.
The same issue exists for iso_connect_cis() calling hci_connect_cis().
Thus, make hci_connect_sco() and hci_connect_cis() return ERR_PTR
instead of NULL.
Reported-and-tested-by: syzbot+37acd5d80d00d609d233@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37acd5d80d00d609d233
Fixes: 06149746e720 ("Bluetooth: hci_conn: Add support for linking multiple hcon")
Signed-off-by: Siddh Raman Pant <code@siddh.me>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers/fpga/fpga-mgr.c')
0 files changed, 0 insertions, 0 deletions