* [PATCH] Fix invalid read of memory in avdtp module
@ 2011-05-27 12:59 Rafal Michalski
2011-05-29 19:10 ` Johan Hedberg
0 siblings, 1 reply; 2+ messages in thread
From: Rafal Michalski @ 2011-05-27 12:59 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Rafal Michalski
Fixed incorrect update of server->sessions GSlist in avdtp_exit.
Previosly it was leading to invalid read of memory (l = l->next)
(and possible memory leaks) since after invoking avdtp_unref in
connection_lost, l pointer was not valid anymore (previously assignment
l = l->next was used after invoking connection_lost in for loop).
---
audio/avdtp.c | 8 +++++++-
1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/audio/avdtp.c b/audio/avdtp.c
index e6407bb..3b2a9ae 100644
--- a/audio/avdtp.c
+++ b/audio/avdtp.c
@@ -3857,9 +3857,15 @@ void avdtp_exit(const bdaddr_t *src)
if (!server)
return;
- for (l = server->sessions; l; l = l->next) {
+ l = server->sessions;
+ while (l) {
struct avdtp *session = l->data;
+ l = l->next;
+ /* value of l pointer should be updated before invoking
+ * connection_lost since it internally uses avdtp_unref
+ * which operates on server->session list as well
+ */
connection_lost(session, -ECONNABORTED);
}
--
1.6.3.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Fix invalid read of memory in avdtp module
2011-05-27 12:59 [PATCH] Fix invalid read of memory in avdtp module Rafal Michalski
@ 2011-05-29 19:10 ` Johan Hedberg
0 siblings, 0 replies; 2+ messages in thread
From: Johan Hedberg @ 2011-05-29 19:10 UTC (permalink / raw)
To: Rafal Michalski; +Cc: linux-bluetooth
Hi Rafal,
On Fri, May 27, 2011, Rafal Michalski wrote:
> Fixed incorrect update of server->sessions GSlist in avdtp_exit.
> Previosly it was leading to invalid read of memory (l = l->next)
> (and possible memory leaks) since after invoking avdtp_unref in
> connection_lost, l pointer was not valid anymore (previously assignment
> l = l->next was used after invoking connection_lost in for loop).
> ---
> audio/avdtp.c | 8 +++++++-
> 1 files changed, 7 insertions(+), 1 deletions(-)
Applied. Thanks.
Johan
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-05-29 19:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-05-27 12:59 [PATCH] Fix invalid read of memory in avdtp module Rafal Michalski
2011-05-29 19:10 ` Johan Hedberg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).