zygo: net/bluetooth: avoid NULL pointer dereference

May  9 15:16:02 faye kernel: [16361.874344] Pid: 4344, comm: bluetoothd Not tainted 3.2.16-zb5s+ #1 ASUSTeK Computer INC. MK90H/MK90H
May  9 15:16:02 faye kernel: [16361.874344] EIP: 0060:[<f84f3f32>] EFLAGS: 00010206 CPU: 1
May  9 15:16:02 faye kernel: [16361.874344] EIP is at __sco_sock_close+0xc2/0x180 [bluetooth]
May  9 15:16:02 faye kernel: [16361.874344] EAX: b73fbe60 EBX: ec1fa400 ECX: f50e28f8 EDX: 00000286
May  9 15:16:02 faye kernel: [16361.874344] ESI: 00000000 EDI: 00000002 EBP: f3f71f30 ESP: f3f71f14
May  9 15:16:02 faye kernel: [16361.874344]  DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
May  9 15:16:02 faye kernel: [16361.874344] Process bluetoothd (pid: 4344, ti=f3f70000 task=f48322b0 task.ti=f3f70000)
May  9 15:16:02 faye kernel: [16361.874344] Stack:
May  9 15:16:02 faye kernel: [16361.874344]  f84f2a87 f3f71f24 81053028 ec1fa400 f3f71f30 ec1fa400 00000000 f3f71f54
May  9 15:16:02 faye bluetoothd[4344]: audio/transport.c:media_owner_free() Owner :1.26
May  9 15:16:02 faye bluetoothd[4344]: audio/transport.c:media_owner_remove() Owner :1.26 Request Acquire
May  9 15:16:02 faye kernel: [16361.874344]  f84f4057 f3f71f5c f3f71f60 00000002 f3f71f54 8144aa42 e48636c0 00000002
May  9 15:16:02 faye kernel: [16361.874344]  f3f71f6c 8144cd32 00000000 00000000 0000000d 00000008 f3f71fac 8144d3b4
May  9 15:16:02 faye kernel: [16361.874344] Call Trace:
May  9 15:16:02 faye kernel: [16361.874344]  [<f84f2a87>] ? sco_sock_clear_timer+0x27/0x60 [bluetooth]
May  9 15:16:02 faye kernel: [16361.874344]  [<81053028>] ? local_bh_enable+0x68/0xd0
May  9 15:16:02 faye kernel: [16361.874344]  [<f84f4057>] sco_sock_shutdown+0x67/0xb0 [bluetooth]
May  9 15:16:02 faye kernel: [16361.874344]  [<8144aa42>] ? sockfd_lookup_light+0x22/0x80
May  9 15:16:02 faye kernel: [16361.874344]  [<8144cd32>] sys_shutdown+0x62/0x70
May  9 15:16:02 faye kernel: [16361.874344]  [<8144d3b4>] sys_socketcall+0x1f4/0x2c0
May  9 15:16:02 faye kernel: [16361.874344]  [<8127fc78>] ? trace_hardirqs_on_thunk+0xc/0x10
May  9 15:16:02 faye kernel: [16361.874344]  [<8152a3df>] sysenter_do_call+0x12/0x2d
May  9 15:16:02 faye kernel: [16361.874344]  [<8152007b>] ? iommu_prepare_identity_map+0xe4/0x1e8
May  9 15:16:02 faye kernel: [16362.052614] Code: 00 08 8d 65 f8 5b 5e 5d c3 8b b3 b8 01 00 00 85 f6 74 9e 89 d8 ba d0 07 00 00 c6 43 0e 08 e8 f6 f3 ff ff 8b 83 b8 01 00 00 8b 30 <f0> ff 4e 08
 0f 94 c0 84 c0 74 26 0f b6 46 19 3c 80 74 33 3c 01
May  9 15:16:02 faye kernel: [16362.052614] EIP: [<f84f3f32>] __sco_sock_close+0xc2/0x180 [bluetooth] SS:ESP 0068:f3f71f14

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index a324b009e34b7bc1b66a91ce9e3a5188169ec04c..2087d52ac6032d02fd106bee7ab35a9fe045ed59 100644 (file)
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -362,6 +362,7 @@ static void sco_sock_kill(struct sock *sk)
 static void __sco_sock_close(struct sock *sk)
 {
        BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
+       if (!sk) return;
 
        switch (sk->sk_state) {
        case BT_LISTEN: