Commit 85e34368 authored by Andrei Emeltchenko's avatar Andrei Emeltchenko Committed by Gustavo Padovan

Bluetooth: Fix dereference after NULL check

Move code dereferencing possible NULL pointer to the check branch.
Signed-off-by: default avatarAndrei Emeltchenko <andrei.emeltchenko@intel.com>
Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
parent 079db0c6
...@@ -382,13 +382,14 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch ...@@ -382,13 +382,14 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
} }
memset(&sec, 0, sizeof(sec)); memset(&sec, 0, sizeof(sec));
if (chan->conn) if (chan->conn) {
sec.level = chan->conn->hcon->sec_level; sec.level = chan->conn->hcon->sec_level;
else
sec.level = chan->sec_level;
if (sk->sk_state == BT_CONNECTED) if (sk->sk_state == BT_CONNECTED)
sec.key_size = chan->conn->hcon->enc_key_size; sec.key_size = chan->conn->hcon->enc_key_size;
} else {
sec.level = chan->sec_level;
}
len = min_t(unsigned int, len, sizeof(sec)); len = min_t(unsigned int, len, sizeof(sec));
if (copy_to_user(optval, (char *) &sec, len)) if (copy_to_user(optval, (char *) &sec, len))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment