Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Bluetooth: Fix potential NULL dereference in SMP channel setup

Browse source 
When the allocation of the L2CAP channel for the BR/EDR security manager
fails, then the smp variable might be NULL. In that case do not try to
free the non-existing crypto contexts

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
This commit is contained in:
Marcel Holtmann 2015-03-17 11:38:24 -07:00 committed by Johan Hedberg
parent 19c5ce9c5f
commit 63511f6d5b
1 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/bluetooth/smp.c
View file

@ -3124,9 +3124,11 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
create_chan: create_chan:
chan = l2cap_chan_create(); chan = l2cap_chan_create();
if (!chan) { if (!chan) {
if (smp) {
crypto_free_blkcipher(smp->tfm_aes); crypto_free_blkcipher(smp->tfm_aes);
crypto_free_hash(smp->tfm_cmac); crypto_free_hash(smp->tfm_cmac);
kzfree(smp); kzfree(smp);
}
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }