Merge "BACKPORT: Bluetooth: Fix potential NULL dereference in RFCOMM bind callback" (70567302) · Commits · e / devices / android_kernel_xiaomi_markw

net/bluetooth/rfcomm/sock.c

+12 −7

Original line number	Diff line number	Diff line
		@@ -335,16 +335,21 @@ static int rfcomm_sock_create(struct net net, struct socket sock,

		static int rfcomm_sock_bind(struct socket sock, struct sockaddr addr, int addr_len)
		{
		struct sockaddr_rc sa = (struct sockaddr_rc ) addr;
		struct sockaddr_rc sa;
		struct sock *sk = sock->sk;
		int chan = sa->rc_channel;
		int err = 0;

		BT_DBG("sk %pK %pMR", sk, &sa->rc_bdaddr);
		int chan;
		int len, err = 0;

		if (!addr \|\| addr->sa_family != AF_BLUETOOTH)
		return -EINVAL;

		memset(&sa, 0, sizeof(sa));
		len = min_t(unsigned int, sizeof(sa), addr_len);
		memcpy(&sa, addr, len);
		chan = sa.rc_channel;

		BT_DBG("sk %pK %pMR", sk, &sa.rc_bdaddr);

		lock_sock(sk);

		if (sk->sk_state != BT_OPEN) {
		@@ -359,11 +364,11 @@ static int rfcomm_sock_bind(struct socket sock, struct sockaddr addr, int addr

		write_lock(&rfcomm_sk_list.lock);

		if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) {
		if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa.rc_bdaddr)) {
		err = -EADDRINUSE;
		} else {
		/* Save source address */
		bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr);
		bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr);
		rfcomm_pi(sk)->channel = chan;
		sk->sk_state = BT_BOUND;
		}