Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()

fourdim · gregkh · commit ab77c8bc3026 · 2026-05-17T17:13:38.000+02:00
commit 0a120d9 upstream. Add the same NULL guard already present in l2cap_sock_resume_cb() and l2cap_sock_ready_cb(). Fixes: 80808e4 ("Bluetooth: Add l2cap_chan_ops abstraction") Cc: stable@kernel.org Signed-off-by: Siwei Zhang <oss@fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
@@ -1464,6 +1464,9 @@ static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
 {
 	struct sock *sk, *parent = chan->data;
 
+	if (!parent)
+		return NULL;
+
 	lock_sock(parent);
 
 	/* Check for backlog size */

Original file line number	Diff line number	Diff line change
`@@ -1464,6 +1464,9 @@ static struct l2cap_chan l2cap_sock_new_connection_cb(struct l2cap_chan chan)`
`1464`	`1464`	`{`
`1465`	`1465`	`struct sock sk, parent = chan->data;`
`1466`	`1466`
	`1467`	`+ if (!parent)`
	`1468`	`+ return NULL;`
	`1469`	`+`
`1467`	`1470`	`lock_sock(parent);`
`1468`	`1471`
`1469`	`1472`	`/* Check for backlog size */`