diff options
| author | Vinicius Costa Gomes | 2012-02-01 22:27:56 +0100 |
|---|---|---|
| committer | Johan Hedberg | 2012-02-13 16:01:31 +0100 |
| commit | f1c09c07cd1a6c1676c4df6450d2b28875e184c1 (patch) | |
| tree | 5056e05979ddddaa25279379bb7b7d2d91978c0a /net/bluetooth/smp.c | |
| parent | Bluetooth: Fix RFCOMM session reference counting issue (diff) | |
| download | kernel-qcow2-linux-f1c09c07cd1a6c1676c4df6450d2b28875e184c1.tar.gz kernel-qcow2-linux-f1c09c07cd1a6c1676c4df6450d2b28875e184c1.tar.xz kernel-qcow2-linux-f1c09c07cd1a6c1676c4df6450d2b28875e184c1.zip | |
Bluetooth: Fix invalid memory access when there's no SMP channel
We only should try to free the SMP channel that was created if there
is a pending SMP session.
Signed-off-by: Vinicius Costa Gomes <vinicius.gomes@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Diffstat (limited to 'net/bluetooth/smp.c')
| -rw-r--r-- | net/bluetooth/smp.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index 581833436afa..9ff56e18d99b 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -263,8 +263,11 @@ static void smp_failure(struct l2cap_conn *conn, u8 reason, u8 send) clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->hcon->flags); mgmt_auth_failed(conn->hcon->hdev, conn->dst, reason); - cancel_delayed_work_sync(&conn->security_timer); - smp_chan_destroy(conn); + + if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) { + cancel_delayed_work_sync(&conn->security_timer); + smp_chan_destroy(conn); + } } #define JUST_WORKS 0x00 @@ -506,7 +509,7 @@ void smp_chan_destroy(struct l2cap_conn *conn) { struct smp_chan *smp = conn->smp_chan; - clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags); + BUG_ON(!smp); if (smp->tfm) crypto_free_blkcipher(smp->tfm); |