• Gopal Tiwari's avatar
    Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data · e8bd76ed
    Gopal Tiwari authored
    kernel panic trace looks like:
    
     #5 [ffffb9e08698fc80] do_page_fault at ffffffffb666e0d7
     #6 [ffffb9e08698fcb0] page_fault at ffffffffb70010fe
        [exception RIP: amp_read_loc_assoc_final_data+63]
        RIP: ffffffffc06ab54f  RSP: ffffb9e08698fd68  RFLAGS: 00010246
        RAX: 0000000000000000  RBX: ffff8c8845a5a000  RCX: 0000000000000004
        RDX: 0000000000000000  RSI: ffff8c8b9153d000  RDI: ffff8c8845a5a000
        RBP: ffffb9e08698fe40   R8: 00000000000330e0   R9: ffffffffc0675c94
        R10: ffffb9e08698fe58  R11: 0000000000000001  R12: ffff8c8b9cbf6200
        R13: 0000000000000000  R14: 0000000000000000  R15: ffff8c8b2026da0b
        ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
     #7 [ffffb9e08698fda8] hci_event_packet at ffffffffc0676904 [bluetooth]
     #8 [ffffb9e08698fe50] hci_rx_work at ffffffffc06629ac [bluetooth]
     #9 [ffffb9e08698fe98] process_one_work at ffffffffb66f95e7
    
    hcon->amp_mgr seems NULL triggered kernel panic in following line inside
    function amp_read_loc_assoc_final_data
    
            set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);
    
    Fixed by checking NULL for mgr.
    Signed-off-by: default avatarGopal Tiwari <gtiwari@redhat.com>
    Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
    e8bd76ed
amp.c 13.9 KB