Bluetooth: Fix handling of unexpected SMP PDUs
authorJohan Hedberg <johan.hedberg@intel.com>
Tue, 29 Jan 2013 16:44:23 +0000 (10:44 -0600)
committerGustavo Padovan <gustavo.padovan@collabora.co.uk>
Thu, 31 Jan 2013 17:35:42 +0000 (15:35 -0200)
commit8cf9fa1240229cbdd888236c0c43fcbad680cf00
tree524b1ceeae4855061df94230815fc0b11e6372b0
parentb7e98b5100aad9290d7f06fcb9d1e80f7f62f05f
Bluetooth: Fix handling of unexpected SMP PDUs

The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected
moments. To avoid NULL pointer dereferences the code should be checking
for this and disconnect if an unexpected SMP PDU arrives. This patch
fixes the issue by adding a check for conn->smp_chan for all other PDUs
except pairing request and security request (which are are the first
PDUs to come to initialize the SMP context).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
CC: stable@vger.kernel.org
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
net/bluetooth/smp.c