summaryrefslogtreecommitdiffstats
path: root/net/bluetooth
diff options
context:
space:
mode:
authorAndrei Emeltchenko <andrei.emeltchenko@intel.com>2012-09-28 14:28:50 +0300
committerGustavo Padovan <gustavo.padovan@collabora.co.uk>2012-10-01 12:02:12 -0300
commitbc8dce4f7b4908bac69acac34d19b4234ba19cee (patch)
tree2dda8509eb59e2f216a0a51087e2a8d1b0a87e2c /net/bluetooth
parent9cb23dd4b6361538eeca33f463b649e8939edde1 (diff)
downloadlinux-bc8dce4f7b4908bac69acac34d19b4234ba19cee.tar.bz2
Bluetooth: A2MP: Fix potential NULL dereference
Return INVALID_CTRL_ID for unknown AMP controller and for BR/EDR controller and fixes dereference possible NULL pointer. Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@intel.com> Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Diffstat (limited to 'net/bluetooth')
-rw-r--r--net/bluetooth/a2mp.c14
1 files changed, 8 insertions, 6 deletions
diff --git a/net/bluetooth/a2mp.c b/net/bluetooth/a2mp.c
index 42788cdbb4fe..d4946b591b71 100644
--- a/net/bluetooth/a2mp.c
+++ b/net/bluetooth/a2mp.c
@@ -278,7 +278,7 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
BT_DBG("id %d", req->id);
hdev = hci_dev_get(req->id);
- if (!hdev) {
+ if (!hdev || hdev->dev_type != HCI_AMP) {
struct a2mp_info_rsp rsp;
rsp.id = req->id;
@@ -286,14 +286,16 @@ static int a2mp_getinfo_req(struct amp_mgr *mgr, struct sk_buff *skb,
a2mp_send(mgr, A2MP_GETINFO_RSP, hdr->ident, sizeof(rsp),
&rsp);
- }
- if (hdev->dev_type != HCI_BREDR) {
- mgr->state = READ_LOC_AMP_INFO;
- hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
+ goto done;
}
- hci_dev_put(hdev);
+ mgr->state = READ_LOC_AMP_INFO;
+ hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
+
+done:
+ if (hdev)
+ hci_dev_put(hdev);
skb_pull(skb, sizeof(*req));
return 0;