On Wed, Sep 09, 2020 at 10:06:59PM -0700, Eric Biggers wrote:

On Thu, Sep 10, 2020 at 10:04:24AM +0530, Anmol Karn wrote:

quoted

Prevent hci_phy_link_complete_evt() from dereferencing 'hcon->amp_mgr'
as NULL. Fix it by adding pointer check for it.

Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f
Signed-off-by: Anmol Karn <redacted>
---
 net/bluetooth/hci_event.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4b7fc430793c..871e16804433 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c

@@ -4936,6 +4936,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev,
 		return;
 	}
 
+	if (IS_ERR_OR_NULL(hcon->amp_mgr)) {
+		hci_dev_unlock(hdev);
+		return;
+	}
+

Hello Sir,

In patches that fix a NULL pointer dereference, please include a brief
explanation of why the pointer can be NULL, including what it means
semantically; and why the proposed change is the best fix for the problem.

I will surely add more explaination in v2.

Also, why IS_ERR_OR_NULL()?

I used IS_ERR_OR_NULL() to check if the 'hcon->amp_mgr' is a valid pointer or not, 
and unregister the 'hcon' and signal error, but will make changes in v2 with only
NULL check included, if you think it's incorrect to use IS_ERR check here along with
NULL.


Thanks,
Anmol Karn