From: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Date: Thu, 19 Jul 2012 14:03:43 +0000 (+0300)
Subject: Bluetooth: smp: Fix possible NULL dereference
X-Git-Tag: next-20120816~99^2~2^2^2~6^2~2
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=d08fd0e712a834d4abb869c0215a702e290bc51e;p=karo-tx-linux.git

Bluetooth: smp: Fix possible NULL dereference

smp_chan_create might return NULL so we need to check before
dereferencing smp.

Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
---

diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 16ef0dc85a0a..901a616c8083 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -579,8 +579,11 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
 
 	if (!test_and_set_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags))
 		smp = smp_chan_create(conn);
+	else
+		smp = conn->smp_chan;
 
-	smp = conn->smp_chan;
+	if (!smp)
+		return SMP_UNSPECIFIED;
 
 	smp->preq[0] = SMP_CMD_PAIRING_REQ;
 	memcpy(&smp->preq[1], req, sizeof(*req));