Bluetooth: Fix potential NULL dereference in SMP channel setup
When the allocation of the L2CAP channel for the BR/EDR security manager fails, then the smp variable might be NULL. In that case do not try to free the non-existing crypto contexts Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
This commit is contained in:
parent
19c5ce9c5f
commit
63511f6d5b
|
@ -3124,9 +3124,11 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
|
|||
create_chan:
|
||||
chan = l2cap_chan_create();
|
||||
if (!chan) {
|
||||
crypto_free_blkcipher(smp->tfm_aes);
|
||||
crypto_free_hash(smp->tfm_cmac);
|
||||
kzfree(smp);
|
||||
if (smp) {
|
||||
crypto_free_blkcipher(smp->tfm_aes);
|
||||
crypto_free_hash(smp->tfm_cmac);
|
||||
kzfree(smp);
|
||||
}
|
||||
return ERR_PTR(-ENOMEM);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue