From d0b02cde2cf89c7d462893ab5d0e5deeeaeb4048 Mon Sep 17 00:00:00 2001 From: Szymon Janc Date: Thu, 28 Oct 2021 16:05:54 +0200 Subject: [PATCH] tests: bluetooth: tester: Fix NULL pointer dereference in error path bt_conn_unref() requires valid conn pointer but could be called with NULL in case valid connection was not found in disconnect_eatt_chans(). Fixes #39851 Signed-off-by: Szymon Janc --- tests/bluetooth/tester/src/l2cap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/bluetooth/tester/src/l2cap.c b/tests/bluetooth/tester/src/l2cap.c index dd83854c31e..5012663eaad 100644 --- a/tests/bluetooth/tester/src/l2cap.c +++ b/tests/bluetooth/tester/src/l2cap.c @@ -342,22 +342,22 @@ void disconnect_eatt_chans(uint8_t *data, uint16_t len) if (!conn) { LOG_ERR("Unknown connection"); status = BTP_STATUS_FAILED; - goto rsp; + goto failed; } for (int i = 0; i < cmd->count; i++) { err = bt_eatt_disconnect_one(conn); if (err) { status = BTP_STATUS_FAILED; - goto rsp; + goto unref; } } status = BTP_STATUS_SUCCESS; -rsp: +unref: bt_conn_unref(conn); - +failed: tester_rsp(BTP_SERVICE_ID_L2CAP, L2CAP_DISCONNECT_EATT_CHANS, CONTROLLER_INDEX, status); }