Re: [PATCH] Bluetooth: Fix null pointer dereference in l2cap_chan_send

On 05/22/2012 09:35 PM, Chanyeol Park wrote:

Hi
On 2012년 05월 21일 09:58, Minho Ban wrote:

quoted

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 3bb1611..98d4541 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c

@@ -727,10 +727,12 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
      if (msg->msg_flags&  MSG_OOB)
          return -EOPNOTSUPP;

-    if (sk->sk_state != BT_CONNECTED)
+    l2cap_chan_lock(chan);
+    if (sk->sk_state != BT_CONNECTED || !chan->conn) {
+        l2cap_chan_unlock(chan);
          return -ENOTCONN;
+    }

-    l2cap_chan_lock(chan);
      err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
      l2cap_chan_unlock(chan);
  

Beside !chan->conn condition,I think it makes sense that sk_state check should be moved after l2cap_chan_lock()
because sk_state could be changed due to l2cap_conn_del().

Thanks, chan->conn condition is not necessary, move sk->sk_state != BT_CONNECTED behind chan_lock is enough.
I'll amend this patch.

Regards
Minho Ban