Skip to content

Commit

Permalink
Bluetooth: Fix handling of unexpected SMP PDUs
Browse files Browse the repository at this point in the history
The conn->smp_chan pointer can be NULL if SMP PDUs arrive at unexpected
moments. To avoid NULL pointer dereferences the code should be checking
for this and disconnect if an unexpected SMP PDU arrives. This patch
fixes the issue by adding a check for conn->smp_chan for all other PDUs
except pairing request and security request (which are are the first
PDUs to come to initialize the SMP context).

Signed-off-by: Johan Hedberg <[email protected]>
CC: [email protected]
Acked-by: Marcel Holtmann <[email protected]>
Signed-off-by: Gustavo Padovan <[email protected]>
  • Loading branch information
Johan Hedberg authored and Gustavo Padovan committed Jan 31, 2013
1 parent b7e98b5 commit 8cf9fa1
Showing 1 changed file with 13 additions and 0 deletions.
13 changes: 13 additions & 0 deletions net/bluetooth/smp.c
Original file line number Diff line number Diff line change
Expand Up @@ -859,6 +859,19 @@ int smp_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)

skb_pull(skb, sizeof(code));

/*
* The SMP context must be initialized for all other PDUs except
* pairing and security requests. If we get any other PDU when
* not initialized simply disconnect (done if this function
* returns an error).
*/
if (code != SMP_CMD_PAIRING_REQ && code != SMP_CMD_SECURITY_REQ &&
!conn->smp_chan) {
BT_ERR("Unexpected SMP command 0x%02x. Disconnecting.", code);
kfree_skb(skb);
return -ENOTSUPP;
}

switch (code) {
case SMP_CMD_PAIRING_REQ:
reason = smp_cmd_pairing_req(conn, skb);
Expand Down

0 comments on commit 8cf9fa1

Please sign in to comment.