diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2014-12-19 06:20:57 +0000 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2018-06-16 22:21:29 +0100 |
| commit | 3738d7b1da4d6f306ca6d5a6a96dd70c36f53f94 (patch) | |
| tree | 875f028673ff2cf04bfe1a42e20cc86461e9ba04 /net | |
| parent | 27d2d1dcad1852a8ddd4bf2068fde34d49f05bfe (diff) | |
| download | linux-stable-3738d7b1da4d6f306ca6d5a6a96dd70c36f53f94.tar.gz linux-stable-3738d7b1da4d6f306ca6d5a6a96dd70c36f53f94.tar.bz2 linux-stable-3738d7b1da4d6f306ca6d5a6a96dd70c36f53f94.zip | |
Bluetooth: hidp_connection_add() unsafe use of l2cap_pi()
commit 51bda2bca53b265715ca1852528f38dc67429d9a upstream.
it's OK after we'd verified the sockets, but not before that.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net')
| -rw-r--r-- | net/bluetooth/hidp/core.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c index 3b45cfee3743..32400034fed4 100644 --- a/net/bluetooth/hidp/core.c +++ b/net/bluetooth/hidp/core.c @@ -1332,13 +1332,14 @@ int hidp_connection_add(struct hidp_connadd_req *req, { struct hidp_session *session; struct l2cap_conn *conn; - struct l2cap_chan *chan = l2cap_pi(ctrl_sock->sk)->chan; + struct l2cap_chan *chan; int ret; ret = hidp_verify_sockets(ctrl_sock, intr_sock); if (ret) return ret; + chan = l2cap_pi(ctrl_sock->sk)->chan; conn = NULL; l2cap_chan_lock(chan); if (chan->conn) { |