Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 51bda2bc authored by Al Viro's avatar Al Viro Committed by Marcel Holtmann
Browse files

Bluetooth: hidp_connection_add() unsafe use of l2cap_pi() 



it's OK after we'd verified the sockets, but not before that.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 004fa5ed

net/bluetooth/hidp/core.c

+2 −1
Original line number Diff line number Diff line
@@ -1314,13 +1314,14 @@ int hidp_connection_add(struct hidp_connadd_req *req, 
{

	struct hidp_session *session;

	struct l2cap_conn *conn;

	struct l2cap_chan *chan = l2cap_pi(ctrl_sock->sk)->chan;

	struct l2cap_chan *chan;

	int ret;



	ret = hidp_verify_sockets(ctrl_sock, intr_sock);

	if (ret)

		return ret;



	chan = l2cap_pi(ctrl_sock->sk)->chan;

	conn = NULL;

	l2cap_chan_lock(chan);

	if (chan->conn)