Commit 63511f6d authored Mar 17, 2015 by Marcel Holtmann Committed by Johan Hedberg Mar 18, 2015

Bluetooth: Fix potential NULL dereference in SMP channel setup



When the allocation of the L2CAP channel for the BR/EDR security manager
fails, then the smp variable might be NULL. In that case do not try to
free the non-existing crypto contexts

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>

parent 19c5ce9c

net/bluetooth/smp.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -3124,9 +3124,11 @@ static struct l2cap_chan smp_add_cid(struct hci_dev hdev, u16 cid)
		create_chan:
		chan = l2cap_chan_create();
		if (!chan) {
		if (smp) {
		crypto_free_blkcipher(smp->tfm_aes);
		crypto_free_hash(smp->tfm_cmac);
		kzfree(smp);
		}
		return ERR_PTR(-ENOMEM);
		}