Re: [Linux-kernel-mentees] [PATCH net] Bluetooth: Fix NULL pointer dereference in amp_read_loc_assoc_final_data()
flat view
From: Dmitry Vyukov <dvyukov@google.com>
Date: 2021-03-03 14:21:39
Also in:
linux-bluetooth, linux-kernel-mentees, lkml
On Sat, Aug 8, 2020 at 6:06 AM Peilin Ye [off-list ref] wrote:
quoted hunk ↗ jump to hunk
Prevent amp_read_loc_assoc_final_data() from dereferencing `mgr` as NULL. Reported-and-tested-by: syzbot+f4fb0eaafdb51c32a153@syzkaller.appspotmail.com Fixes: 9495b2ee757f ("Bluetooth: AMP: Process Chan Selected event") Signed-off-by: Peilin Ye <redacted> --- net/bluetooth/amp.c | 3 +++ 1 file changed, 3 insertions(+)diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c index 9c711f0dfae3..be2d469d6369 100644 --- a/net/bluetooth/amp.c +++ b/net/bluetooth/amp.c@@ -297,6 +297,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev, struct hci_request req; int err; + if (!mgr) + return; + cp.phy_handle = hcon->handle; cp.len_so_far = cpu_to_le16(0); cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
Not sure what happened here, but the merged patch somehow has a different author and no Reported-by tag: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e8bd76ede155fd54d8c41d045dda43cd3174d506 so let's tell syzbot what fixed it manually: #syz fix: Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data