[PATCH] net: bluetooth: hci_sock: Fix a possible null-pointer dereference in hci_mgmt_cmd()

[Jia-Ju Bai]

In hci_mgmt_cmd(), there is an if statement on line 1570 to check
whether hdev is NULL:
    if (hdev && chan->hdev_init)

When hdev is NULL, it is used on line 1575:
    err = handler->func(sk, hdev, cp, len);

Some called functions of handler->func use hdev, such as:
set_appearance(), add_device() and remove_device() in mgmt.c.

Thus, a possible null-pointer dereference may occur.

To fix this bug, hdev is checked before calling handler->func().

This bug is found by a static analysis tool STCheck written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1...@gmail.com>
---
 net/bluetooth/hci_sock.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index d32077b28433..18ea1e47ea48 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1570,11 +1570,12 @@ static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, 
struct sock *sk,
        if (hdev && chan->hdev_init)
                chan->hdev_init(sk, hdev);
 
-       cp = buf + sizeof(*hdr);
-
-       err = handler->func(sk, hdev, cp, len);
-       if (err < 0)
-               goto done;
+       if (hdev) {
+               cp = buf + sizeof(*hdr);
+               err = handler->func(sk, hdev, cp, len);
+               if (err < 0)
+                       goto done;
+       }
 
        err = msglen;
 
-- 
2.17.0