Bluetooth: Fix potential NULL pointer dereference in smp_conn_security

From: Johan Hedberg <[email protected]>

The smp pointer might not be initialized for jumps to the "done" label in the smp_conn_security function. Furthermore doing the set_bit after done might "overwrite" a previous value of the flag in case pairing was already in progress. This patch moves the call to set_bit before the label so that it is only done for a newly created smp context (as returned by smp_chan_create).

---
 net/bluetooth/smp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 2c7370844731..dfb4e1161c10 100644
@@ -928,9 +928,9 @@ int smp_conn_security(struct hci_conn *hcon, __u8 sec_level)
 		smp_send_cmd(conn, SMP_CMD_SECURITY_REQ, sizeof(cp), &cp);
 	}
 
-done:
 	set_bit(SMP_FLAG_INITIATOR, &smp->smp_flags);
 
+done:
 	hcon->pending_sec_level = sec_level;
 
 	return 0;

1.8.5.3

Hi Johan,

patch has been applied to bluetooth-next tree.

Regards

Marcel