Bluetooth: hidp_connection_add() unsafe use of l2cap_pi()
authorAl Viro <viro@zeniv.linux.org.uk>
Fri, 19 Dec 2014 06:20:57 +0000 (06:20 +0000)
committerMarcel Holtmann <marcel@holtmann.org>
Fri, 19 Dec 2014 12:40:07 +0000 (13:40 +0100)
it's OK after we'd verified the sockets, but not before that.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
net/bluetooth/hidp/core.c

index cc25d0b74b3609ef800453484eef7e0f55767162..07348e142f16a783b7764d72314830f4b7844330 100644 (file)
@@ -1314,13 +1314,14 @@ int hidp_connection_add(struct hidp_connadd_req *req,
 {
        struct hidp_session *session;
        struct l2cap_conn *conn;
-       struct l2cap_chan *chan = l2cap_pi(ctrl_sock->sk)->chan;
+       struct l2cap_chan *chan;
        int ret;
 
        ret = hidp_verify_sockets(ctrl_sock, intr_sock);
        if (ret)
                return ret;
 
+       chan = l2cap_pi(ctrl_sock->sk)->chan;
        conn = NULL;
        l2cap_chan_lock(chan);
        if (chan->conn)