Bluetooth: Fix handling of unexpected SMP PDUs
authorJohan Hedberg <johan.hedberg@intel.com>
Tue, 29 Jan 2013 16:44:23 +0000 (10:44 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 14 Feb 2013 18:48:53 +0000 (10:48 -0800)
commita256a4c2001293548f0851b66ea8f39b704bac72
tree304505ae5ae7959b388c3c919975b738e2492af1
parent7308f843f36c30dd1247989a45611760567ea44f
Bluetooth: Fix handling of unexpected SMP PDUs

commit 8cf9fa1240229cbdd888236c0c43fcbad680cf00 upstream.

The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected
moments. To avoid NULL pointer dereferences the code should be checking
for this and disconnect if an unexpected SMP PDU arrives. This patch
fixes the issue by adding a check for conn->smp_chan for all other PDUs
except pairing request and security request (which are are the first
PDUs to come to initialize the SMP context).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/bluetooth/smp.c