Johan Hedberg 0a66cf2036 Bluetooth: Fix potential NULL pointer dereference in SMP ... If a sudden disconnection happens the l2cap_conn pointer may already have been cleaned up by the time hci_conn_security gets called, resulting in the following oops if we don't have a proper NULL check: BUG: unable to handle kernel NULL pointer dereference at 000000c8 IP: [<c132e2ed>] smp_conn_security+0x26/0x151 *pde = 00000000 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 1 PID: 673 Comm: memcheck-x86-li Not tainted 3.14.0-rc2+ #437 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 task: f0ef0520 ti: f0d6a000 task.ti: f0d6a000 EIP: 0060:[<c132e2ed>] EFLAGS: 00010246 CPU: 1 EIP is at smp_conn_security+0x26/0x151 EAX: f0ec1770 EBX: f0ec1770 ECX: 00000002 EDX: 00000002 ESI: 00000002 EDI: 00000000 EBP: f0d6bdc0 ESP: f0d6bda0 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 CR0: 80050033 CR2: 000000c8 CR3: 30f0f000 CR4: 00000690 Stack: f4f55000 00000002 f0d6bdcc c1097a2b c1319f40 f0ec1770 00000002 f0d6bdd0 f0d6bde8 c1312a82 f0d6bdfc c1312a82 c1319f84 00000008 f4d81c20 f0e5fd86 f0ec1770 f0d6bdfc f0d6be28 c131be3b c131bdc1 f0d25270 c131be3b 00000008 Call Trace: [<c1097a2b>] ? __kmalloc+0x118/0x128 [<c1319f40>] ? mgmt_pending_add+0x49/0x9b [<c1312a82>] hci_conn_security+0x4a/0x1dd [<c1312a82>] ? hci_conn_security+0x4a/0x1dd [<c1319f84>] ? mgmt_pending_add+0x8d/0x9b [<c131be3b>] pair_device+0x1e1/0x206 [<c131bdc1>] ? pair_device+0x167/0x206 [<c131be3b>] ? pair_device+0x1e1/0x206 [<c131ed44>] mgmt_control+0x275/0x2d6 Signed-off-by: Johan Hedberg <johan.hedberg@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>		2014-03-24 07:51:55 -07:00
..
bnep	net/*: Fix FSF address in file headers	2013-12-06 12:37:57 -05:00
cmtp	Bluetooth: Access CMTP session addresses through L2CAP channel	2013-10-13 20:00:30 +03:00
hidp	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2013-11-04 14:51:28 -05:00
rfcomm	Bluetooth: Convert uses of __constant_<foo> to <foo>	2014-03-12 11:10:17 -07:00
6lowpan.c	Bluetooth: Fix 6loWPAN peer lookup	2014-01-07 11:32:15 -02:00
6lowpan.h	Bluetooth: make bluetooth 6lowpan as an option	2014-03-11 07:54:55 -07:00
a2mp.c	Bluetooth: Convert uses of __constant_<foo> to <foo>	2014-03-12 11:10:17 -07:00
a2mp.h	Bluetooth: Move a2mp.h header file into net/bluetooth/	2013-10-11 00:10:05 +02:00
af_bluetooth.c	Bluetooth: Increase minor version of core module	2014-02-21 06:21:55 +02:00
amp.c	Bluetooth: Remove l2cap_conn->dst usage from AMP manager	2013-10-13 17:43:32 +03:00
amp.h	Bluetooth: Move amp.h header file into net/bluetooth/	2013-10-11 00:10:03 +02:00
hci_conn.c	Bluetooth: Enforce strict Secure Connections Only mode security	2014-03-19 23:30:32 +02:00
hci_core.c	Bluetooth: Convert uses of __constant_<foo> to <foo>	2014-03-12 11:10:17 -07:00
hci_event.c	Bluetooth: Track current configured LE scan type parameter	2014-03-21 22:02:12 +02:00
hci_sock.c	Bluetooth: Convert uses of __constant_<foo> to <foo>	2014-03-12 11:10:17 -07:00
hci_sysfs.c	Bluetooth: Convert to use ATTRIBUTE_GROUPS macro	2014-02-13 09:51:34 +02:00
Kconfig	Bluetooth: make sure 6LOWPAN_IPHC is built-in if needed	2014-03-13 07:05:10 -07:00
l2cap_core.c	Bluetooth: Convert uses of __constant_<foo> to <foo>	2014-03-12 11:10:17 -07:00
l2cap_sock.c	Bluetooth: Convert uses of __constant_<foo> to <foo>	2014-03-12 11:10:17 -07:00
lib.c	bluetooth: Remove unneeded batostr function	2012-09-27 18:10:43 -03:00
Makefile	Bluetooth: make bluetooth 6lowpan as an option	2014-03-11 07:54:55 -07:00
mgmt.c	Bluetooth: Fix address value for early disconnection events	2014-03-20 09:14:26 -07:00
sco.c	Bluetooth: Convert uses of __constant_<foo> to <foo>	2014-03-12 11:10:17 -07:00
smp.c	Bluetooth: Fix potential NULL pointer dereference in SMP	2014-03-24 07:51:55 -07:00
smp.h	Bluetooth: Increase SMP re-encryption delay to 500ms	2014-03-19 13:55:06 -07:00