From: Szymon Janc Date: Mon, 28 Feb 2011 13:09:50 +0000 (+0100) Subject: Bluetooth: Fix possible NULL pointer dereference in cmd_complete X-Git-Tag: firefly_0821_release~7613^2~967^2~16^2~578^2~79^2~4 X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=8020c16a6c9fc8d6a5217be8d005f2fc558f6ab5;p=firefly-linux-kernel-4.4.55.git Bluetooth: Fix possible NULL pointer dereference in cmd_complete It is now possible to create command complete event without specific reply data by passing NULL as reply with len 0. Check pointer before calling memcpy to avoid undefined behaviour. Signed-off-by: Szymon Janc Signed-off-by: Gustavo F. Padovan --- diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 46c3edc72cd1..34f58f4ad12b 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -92,7 +92,9 @@ static int cmd_complete(struct sock *sk, u16 index, u16 cmd, void *rp, ev = (void *) skb_put(skb, sizeof(*ev) + rp_len); put_unaligned_le16(cmd, &ev->opcode); - memcpy(ev->data, rp, rp_len); + + if (rp) + memcpy(ev->data, rp, rp_len); if (sock_queue_rcv_skb(sk, skb) < 0) kfree_skb(skb);