Bluetooth: Fix null pointer deref on unexpected status event

__hci_cmd_sync returns NULL if the controller responds with a status
event. This is unexpected for the commands sent here, but on
occurrence leads to null pointer dereferences and thus must be
handled.

Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/aosp.c b/net/bluetooth/aosp.c
index 432ae3aac9e31d60375f60f81a604f8fed3c944c..1d67836e95e16935bcfd52abd2ba6e33c2eb6e89 100644 (file)
--- a/net/bluetooth/aosp.c
+++ b/net/bluetooth/aosp.c
@@ -54,7 +54,10 @@ void aosp_do_open(struct hci_dev *hdev)
        /* LE Get Vendor Capabilities Command */
        skb = __hci_cmd_sync(hdev, hci_opcode_pack(0x3f, 0x153), 0, NULL,
                             HCI_CMD_TIMEOUT);
-       if (IS_ERR(skb)) {
+       if (IS_ERR_OR_NULL(skb)) {
+               if (!skb)
+                       skb = ERR_PTR(-EIO);
+
                bt_dev_err(hdev, "AOSP get vendor capabilities (%ld)",
                           PTR_ERR(skb));
                return;
@@ -152,7 +155,10 @@ static int enable_quality_report(struct hci_dev *hdev)
 
        skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,
                             HCI_CMD_TIMEOUT);
-       if (IS_ERR(skb)) {
+       if (IS_ERR_OR_NULL(skb)) {
+               if (!skb)
+                       skb = ERR_PTR(-EIO);
+
                bt_dev_err(hdev, "Enabling Android BQR failed (%ld)",
                           PTR_ERR(skb));
                return PTR_ERR(skb);
@@ -171,7 +177,10 @@ static int disable_quality_report(struct hci_dev *hdev)
 
        skb = __hci_cmd_sync(hdev, BQR_OPCODE, sizeof(cp), &cp,
                             HCI_CMD_TIMEOUT);
-       if (IS_ERR(skb)) {
+       if (IS_ERR_OR_NULL(skb)) {
+               if (!skb)
+                       skb = ERR_PTR(-EIO);
+
                bt_dev_err(hdev, "Disabling Android BQR failed (%ld)",
                           PTR_ERR(skb));
                return PTR_ERR(skb);

diff --git a/net/bluetooth/msft.c b/net/bluetooth/msft.c
index 14975769f67871422da3d08dbc6f4095e3c6451b..bee6a4c656be4db573b11a813727f71429c9a9f1 100644 (file)
--- a/net/bluetooth/msft.c
+++ b/net/bluetooth/msft.c
@@ -120,7 +120,10 @@ static bool read_supported_features(struct hci_dev *hdev,
 
        skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,
                             HCI_CMD_TIMEOUT);
-       if (IS_ERR(skb)) {
+       if (IS_ERR_OR_NULL(skb)) {
+               if (!skb)
+                       skb = ERR_PTR(-EIO);
+
                bt_dev_err(hdev, "Failed to read MSFT supported features (%ld)",
                           PTR_ERR(skb));
                return false;
@@ -319,8 +322,11 @@ static int msft_remove_monitor_sync(struct hci_dev *hdev,
 
        skb = __hci_cmd_sync(hdev, hdev->msft_opcode, sizeof(cp), &cp,
                             HCI_CMD_TIMEOUT);
-       if (IS_ERR(skb))
+       if (IS_ERR_OR_NULL(skb)) {
+               if (!skb)
+                       return -EIO;
                return PTR_ERR(skb);
+       }
 
        return msft_le_cancel_monitor_advertisement_cb(hdev, hdev->msft_opcode,
                                                       monitor, skb);
@@ -432,8 +438,11 @@ static int msft_add_monitor_sync(struct hci_dev *hdev,
                             HCI_CMD_TIMEOUT);
        kfree(cp);
 
-       if (IS_ERR(skb))
+       if (IS_ERR_OR_NULL(skb)) {
+               if (!skb)
+                       return -EIO;
                return PTR_ERR(skb);
+       }
 
        return msft_le_monitor_advertisement_cb(hdev, hdev->msft_opcode,
                                                monitor, skb);