- grab ng_btsocket_l2cap_sockets_mtx lock in

  ng_btsocket_l2cap_process_l2ca_enc_change()
  before calling ng_btsocket_l2cap_pcb_by_cid();

- handle possible NULL value returned from
  ng_btsocket_l2cap_pcb_by_cid();

Submitted by:	Hans Petter Selasky; hps at selasky dot org
MFC after:	1 week

1 files changed, 8 insertions, 0 deletions

diff --git a/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c b/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
index d044ad9..57628b0 100644
--- a/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
+++ b/sys/netgraph/bluetooth/socket/ng_btsocket_l2cap.c
@@ -708,8 +708,15 @@ static int ng_btsocket_l2cap_process_l2ca_enc_change(struct ng_mesg *msg, ng_bts
 
 	op = (ng_l2cap_l2ca_enc_chg_op *)(msg->data);
 
+	mtx_lock(&ng_btsocket_l2cap_sockets_mtx);
+
 	pcb = ng_btsocket_l2cap_pcb_by_cid(&rt->src, op->lcid,
 					   op->idtype);
+	if (pcb == NULL) {
+		mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
+		return (ENOENT);
+	}
+
 	mtx_lock(&pcb->pcb_mtx);
 	pcb->encryption = op->result;
 	
@@ -729,6 +736,7 @@ static int ng_btsocket_l2cap_process_l2ca_enc_change(struct ng_mesg *msg, ng_bts
 		}
 	}
 	mtx_unlock(&pcb->pcb_mtx);
+	mtx_unlock(&ng_btsocket_l2cap_sockets_mtx);
 
 	return 0;
 }