Bluetooth: Fix out of scope variable access in hci_sock_cmsg()

The pointer data can point to the variable ctv.
Access to data happens when ctv is already out of scope.

Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

1 files changed, 3 insertions, 1 deletions

diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 688cfebfbee0..38f08f6b86f6 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -329,6 +329,9 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
         }
 
         if (mask & HCI_CMSG_TSTAMP) {
+#ifdef CONFIG_COMPAT
+                struct compat_timeval ctv;
+#endif
                 struct timeval tv;
                 void *data;
                 int len;
@@ -339,7 +342,6 @@ static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_
                 len = sizeof(tv);
 #ifdef CONFIG_COMPAT
                 if (msg->msg_flags & MSG_CMSG_COMPAT) {
-                        struct compat_timeval ctv;
                         ctv.tv_sec = tv.tv_sec;
                         ctv.tv_usec = tv.tv_usec;
                         data = &ctv;