Bluetooth: MGMT: Add error handling to pair_device()

hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error handling in the function. Cc: Stable <[email protected]> Fixes: 5157b8a ("Bluetooth: Fix initializing conn_params in scan phase") Signed-off-by: Griffin Kroah-Hartman <[email protected]> Reported-by: Yiwei Zhang <[email protected]> Signed-off-by: Luiz Augusto von Dentz <[email protected]>
bluez · Aug 15, 2024 · f2ed8d6 · f2ed8d6
1 parent a7e36fd
commit f2ed8d6
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
@@ -3456,6 +3456,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
 		 * will be kept and this function does nothing.
 		 */
 		p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
+		if (!p) {
+			err = -EIO;
+			goto unlock;
+		}
 
 		if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
 			p->auto_connect = HCI_AUTO_CONN_DISABLED;