Bluetooth: MGMT: Add error handling to pair_device()

commit 538fd3921afac97158d4177139a0ad39f056dbb2 upstream.

hci_conn_params_add() never checks for a NULL value and could lead to a NULL
pointer dereference causing a crash.

Fixed by adding error handling in the function.

Cc: Stable <stable@kernel.org>
Fixes: 5157b8a503fa ("Bluetooth: Fix initializing conn_params in scan phase")
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Reported-by: Yiwei Zhang <zhan4630@purdue.edu>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 80f220b7e19d5560df42e807c20c70622e3bc205..ad4793ea052df9671c9ffb04aad5dbc18561192d 100644 (file)
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -3457,6 +3457,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 * will be kept and this function does nothing.
                 */
                p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type);
+               if (!p) {
+                       err = -EIO;
+                       goto unlock;
+               }
 
                if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT)
                        p->auto_connect = HCI_AUTO_CONN_DISABLED;