Anmol Karn 79259a593e Bluetooth: Fix null pointer dereference in hci_event_packet() ...

[ Upstream commit 6dfccd13db ]

AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called
from hci_event_packet() and there is a possibility, that hcon->amp_mgr may
not be found when accessing after initialization of hcon.

- net/bluetooth/hci_event.c:4945
The bug seems to get triggered in this line:

bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status.

Fixes: d5e911928b ("Bluetooth: AMP: Process Physical Link Complete evt")
Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <anmol.karan123@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-05-16 09:56:52 +09:00

..

bnep

Bluetooth: bnep: fix possible might sleep error in bnep_session

2017-08-30 10:21:52 +02:00

cmtp

Bluetooth: cmtp: fix possible might sleep error in cmtp_session

2017-08-30 10:21:52 +02:00

hidp

Bluetooth: hidp: fix buffer overflow

2023-05-15 12:40:01 +09:00

rfcomm

Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl

2023-05-15 17:13:22 +09:00

6lowpan.c

Bluetooth: add a mutex lock to avoid UAF in do_enale_set

2023-05-16 08:45:50 +09:00

a2mp.c

Bluetooth: A2MP: Fix not initializing all members

2023-05-16 09:27:41 +09:00

a2mp.h

Bluetooth: Add BT_HS config option

2015-07-30 13:31:59 +02:00

af_bluetooth.c

Merge 4.9.89 into android-4.9

2018-03-22 09:54:47 +01:00

amp.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2020-12-18 12:46:08 +09:00

amp.h

Bluetooth: Add BT_HS config option

2015-07-30 13:31:59 +02:00

ecc.c

Bluetooth: Add ECC library for LE Secure Connections

2014-12-03 16:51:16 +01:00

ecc.h

Bluetooth: Add ECC library for LE Secure Connections

2014-12-03 16:51:16 +01:00

hci_conn.c

Bluetooth: Disconnect if E0 is used for Level 4

2023-05-16 09:27:52 +09:00

hci_core.c

Bluetooth: hci_core: fix init for HCI_USER_CHANNEL

2023-05-15 16:18:52 +09:00

hci_debugfs.c

Bluetooth: Add debugfs fields for hardware and firmware info

2016-07-18 09:33:28 +03:00

hci_debugfs.h

Bluetooth: Provide option to enable/disable debugfs information

2015-02-15 18:54:13 +02:00

hci_event.c

Bluetooth: Fix null pointer dereference in hci_event_packet()

2023-05-16 09:56:52 +09:00

hci_request.c

Bluetooth: Fix advertising duplicated flags

2023-05-15 16:19:02 +09:00

hci_request.h

Bluetooth: Fix append max 11 bytes of name to scan rsp data

2016-10-19 18:42:37 +02:00

hci_sock.c

Bluetooth: Fix race condition in hci_release_sock()

2023-05-15 16:54:33 +09:00

hci_sysfs.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2020-12-18 12:46:08 +09:00

Kconfig

Bluetooth: add LED trigger for indicating HCI is powered up

2016-02-23 20:29:35 +01:00

l2cap_core.c

Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel

2023-05-16 09:27:45 +09:00

l2cap_sock.c

Bluetooth: Only mark socket zapped after unlocking

2023-05-16 09:40:05 +09:00

leds.c

Bluetooth: Add combined LED trigger for controller power

2016-09-19 20:19:34 +02:00

leds.h

Bluetooth: Add combined LED trigger for controller power

2016-09-19 20:19:34 +02:00

lib.c

Bluetooth: Add BT_WARN and bt_dev_warn logging macros

2015-09-24 16:25:44 +02:00

Makefile

Bluetooth: add LED trigger for indicating HCI is powered up

2016-02-23 20:29:35 +01:00

mgmt_util.c

Bluetooth: Add support for sending MGMT commands and events to monitor

2016-09-19 20:19:34 +02:00

mgmt_util.h

Bluetooth: Add generic mgmt helper API

2015-03-17 18:03:08 +01:00

mgmt.c

Bluetooth: MGMT: Fix not checking if BT_HS is enabled

2023-05-16 09:27:47 +09:00

sco.c

Bluetooth: avoid killing an already killed socket

2023-05-12 16:57:50 +09:00

selftest.c

Bluetooth: Export ECDH selftest result in debugfs

2015-04-02 08:47:38 +03:00

selftest.h

Bluetooth: Add support for self testing framework

2014-12-30 08:53:55 +02:00

smp.c

Bluetooth: Add SMP workaround Microsoft Surface Precision Mouse bug

2023-05-15 14:03:00 +09:00

smp.h

Bluetooth: SMP: fix crash in unpairing

2023-05-15 09:11:48 +09:00