Re: [PATCH] Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Gopal,

> kernel panic trace looks like: 
> 
> #5 [ffffb9e08698fc80] do_page_fault at ffffffffb666e0d7
> #6 [ffffb9e08698fcb0] page_fault at ffffffffb70010fe
>    [exception RIP: amp_read_loc_assoc_final_data+63]
>    RIP: ffffffffc06ab54f  RSP: ffffb9e08698fd68  RFLAGS: 00010246
>    RAX: 0000000000000000  RBX: ffff8c8845a5a000  RCX: 0000000000000004
>    RDX: 0000000000000000  RSI: ffff8c8b9153d000  RDI: ffff8c8845a5a000
>    RBP: ffffb9e08698fe40   R8: 00000000000330e0   R9: ffffffffc0675c94
>    R10: ffffb9e08698fe58  R11: 0000000000000001  R12: ffff8c8b9cbf6200
>    R13: 0000000000000000  R14: 0000000000000000  R15: ffff8c8b2026da0b
>    ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
> #7 [ffffb9e08698fda8] hci_event_packet at ffffffffc0676904 [bluetooth]
> #8 [ffffb9e08698fe50] hci_rx_work at ffffffffc06629ac [bluetooth]
> #9 [ffffb9e08698fe98] process_one_work at ffffffffb66f95e7
> 
> hcon->amp_mgr seems NULL triggered kernel panic in following line inside
> function amp_read_loc_assoc_final_data
> 
>        set_bit(READ_LOC_AMP_ASSOC_FINAL, &mgr->state);
> 
> Fixed by checking NULL for mgr.
> 
> Signed-off-by: Gopal Tiwari <gtiwari@xxxxxxxxxx>
> ---
> net/bluetooth/amp.c | 3 +++
> 1 file changed, 3 insertions(+)

patch has been applied to bluetooth-next tree.

Regards

Marcel




[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux