* [PATCH] Bluetooth: Remove double free of skb pointer
@ 2009-12-22 13:29 Andrei Emeltchenko
2009-12-22 13:34 ` Andrei Emeltchenko
0 siblings, 1 reply; 5+ messages in thread
From: Andrei Emeltchenko @ 2009-12-22 13:29 UTC (permalink / raw)
To: linux-bluetooth
[-- Attachment #1: Type: text/plain, Size: 931 bytes --]
From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Trivial fix for double free of skb pointer with kfree_skb to
make code simplier and cleaner.
skb is already freed within l2cap_data_channel_iframe function.
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
---
net/bluetooth/l2cap.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf1..9584b97 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3574,9 +3574,7 @@ static inline int l2cap_data_channel(struct
l2cap_conn *conn, u16 cid, struct sk
else
err = l2cap_data_channel_sframe(sk, control, skb);
- if (!err)
- goto done;
- break;
+ goto done;
case L2CAP_MODE_STREAMING:
control = get_unaligned_le16(skb->data);
--
1.6.0.4
[-- Attachment #2: 0001-Bluetooth-Remove-double-free-of-skb-pointer.patch --]
[-- Type: text/x-patch, Size: 995 bytes --]
From fb5bfc6157028c6047a8f9ef60abcef89aa243d4 Mon Sep 17 00:00:00 2001
From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Date: Tue, 22 Dec 2009 15:05:06 +0200
Subject: [PATCH] Bluetooth: Remove double free of skb pointer
Trivial fix for double free of skb pointer with kfree_skb to
make code simplier and cleaner.
skb is already freed within l2cap_data_channel_iframe function.
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
---
net/bluetooth/l2cap.c | 4 +---
1 files changed, 1 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf1..9584b97 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3574,9 +3574,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
else
err = l2cap_data_channel_sframe(sk, control, skb);
- if (!err)
- goto done;
- break;
+ goto done;
case L2CAP_MODE_STREAMING:
control = get_unaligned_le16(skb->data);
--
1.6.0.4
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] Bluetooth: Remove double free of skb pointer
2009-12-22 13:29 [PATCH] Bluetooth: Remove double free of skb pointer Andrei Emeltchenko
@ 2009-12-22 13:34 ` Andrei Emeltchenko
0 siblings, 0 replies; 5+ messages in thread
From: Andrei Emeltchenko @ 2009-12-22 13:34 UTC (permalink / raw)
To: linux-bluetooth
I will resend it shortly. Sorry.
On Tue, Dec 22, 2009 at 3:29 PM, Andrei Emeltchenko
<andrei.emeltchenko.news@gmail.com> wrote:
> From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
>
> Trivial fix for double free of skb pointer with kfree_skb to
> make code simplier and cleaner.
>
> skb is already freed within l2cap_data_channel_iframe function.
>
> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
> ---
> net/bluetooth/l2cap.c | 4 +---
> 1 files changed, 1 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
> index 1120cf1..9584b97 100644
> --- a/net/bluetooth/l2cap.c
> +++ b/net/bluetooth/l2cap.c
> @@ -3574,9 +3574,7 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> else
> err = l2cap_data_channel_sframe(sk, control, skb);
>
> - if (!err)
> - goto done;
> - break;
> + goto done;
>
> case L2CAP_MODE_STREAMING:
> control = get_unaligned_le16(skb->data);
> --
> 1.6.0.4
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] Bluetooth: Remove double free of skb pointer
@ 2009-12-22 14:56 Andrei Emeltchenko
2010-01-05 22:33 ` Gustavo F. Padovan
2010-01-07 3:47 ` Marcel Holtmann
0 siblings, 2 replies; 5+ messages in thread
From: Andrei Emeltchenko @ 2009-12-22 14:56 UTC (permalink / raw)
To: linux-bluetooth
[-- Attachment #1: Type: text/plain, Size: 1441 bytes --]
Trivial fix for double free of skb pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
---
net/bluetooth/l2cap.c | 11 ++++-------
1 files changed, 4 insertions(+), 7 deletions(-)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf1..8acc19e 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3518,7 +3518,6 @@ static inline int l2cap_data_channel(struct
l2cap_conn *conn, u16 cid, struct sk
struct l2cap_pinfo *pi;
u16 control, len;
u8 tx_seq;
- int err;
sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
if (!sk) {
@@ -3570,13 +3569,11 @@ static inline int l2cap_data_channel(struct
l2cap_conn *conn, u16 cid, struct sk
goto drop;
if (__is_iframe(control))
- err = l2cap_data_channel_iframe(sk, control, skb);
+ l2cap_data_channel_iframe(sk, control, skb);
else
- err = l2cap_data_channel_sframe(sk, control, skb);
+ l2cap_data_channel_sframe(sk, control, skb);
- if (!err)
- goto done;
- break;
+ goto done;
case L2CAP_MODE_STREAMING:
control = get_unaligned_le16(skb->data);
@@ -3602,7 +3599,7 @@ static inline int l2cap_data_channel(struct
l2cap_conn *conn, u16 cid, struct sk
else
pi->expected_tx_seq = tx_seq + 1;
- err = l2cap_sar_reassembly_sdu(sk, skb, control);
+ l2cap_sar_reassembly_sdu(sk, skb, control);
goto done;
--
1.6.0.4
[-- Attachment #2: 0001-Bluetooth-Remove-double-free-of-skb-pointer.patch --]
[-- Type: text/x-patch, Size: 1677 bytes --]
From b1a7a03ae566416636f443f3d201dc745dfeb0b7 Mon Sep 17 00:00:00 2001
From: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
Date: Tue, 22 Dec 2009 15:58:08 +0200
Subject: [PATCH] Bluetooth: Remove double free of skb pointer
Trivial fix for double free of skb pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.
Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
---
net/bluetooth/l2cap.c | 11 ++++-------
1 files changed, 4 insertions(+), 7 deletions(-)
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf1..8acc19e 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3518,7 +3518,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
struct l2cap_pinfo *pi;
u16 control, len;
u8 tx_seq;
- int err;
sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
if (!sk) {
@@ -3570,13 +3569,11 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
goto drop;
if (__is_iframe(control))
- err = l2cap_data_channel_iframe(sk, control, skb);
+ l2cap_data_channel_iframe(sk, control, skb);
else
- err = l2cap_data_channel_sframe(sk, control, skb);
+ l2cap_data_channel_sframe(sk, control, skb);
- if (!err)
- goto done;
- break;
+ goto done;
case L2CAP_MODE_STREAMING:
control = get_unaligned_le16(skb->data);
@@ -3602,7 +3599,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
else
pi->expected_tx_seq = tx_seq + 1;
- err = l2cap_sar_reassembly_sdu(sk, skb, control);
+ l2cap_sar_reassembly_sdu(sk, skb, control);
goto done;
--
1.6.0.4
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] Bluetooth: Remove double free of skb pointer
2009-12-22 14:56 Andrei Emeltchenko
@ 2010-01-05 22:33 ` Gustavo F. Padovan
2010-01-07 3:47 ` Marcel Holtmann
1 sibling, 0 replies; 5+ messages in thread
From: Gustavo F. Padovan @ 2010-01-05 22:33 UTC (permalink / raw)
To: Andrei Emeltchenko; +Cc: linux-bluetooth
On Tue, Dec 22, 2009 at 12:56 PM, Andrei Emeltchenko
<andrei.emeltchenko.news@gmail.com> wrote:
> Trivial fix for double free of skb pointer with kfree_skb to
> make code simplier and cleaner. Remove unused variable err.
>
> Signed-off-by: Andrei Emeltchenko <andrei.emeltchenko@nokia.com>
> ---
> net/bluetooth/l2cap.c | 11 ++++-------
> 1 files changed, 4 insertions(+), 7 deletions(-)
>
> diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
> index 1120cf1..8acc19e 100644
> --- a/net/bluetooth/l2cap.c
> +++ b/net/bluetooth/l2cap.c
> @@ -3518,7 +3518,6 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> struct l2cap_pinfo *pi;
> u16 control, len;
> u8 tx_seq;
> - int err;
>
> sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
> if (!sk) {
> @@ -3570,13 +3569,11 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> goto drop;
>
> if (__is_iframe(control))
> - err = l2cap_data_channel_iframe(sk, control, skb);
> + l2cap_data_channel_iframe(sk, control, skb);
> else
> - err = l2cap_data_channel_sframe(sk, control, skb);
> + l2cap_data_channel_sframe(sk, control, skb);
>
> - if (!err)
> - goto done;
> - break;
> + goto done;
>
> case L2CAP_MODE_STREAMING:
> control = get_unaligned_le16(skb->data);
> @@ -3602,7 +3599,7 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> else
> pi->expected_tx_seq = tx_seq + 1;
>
> - err = l2cap_sar_reassembly_sdu(sk, skb, control);
> + l2cap_sar_reassembly_sdu(sk, skb, control);
>
> goto done;
>
> --
> 1.6.0.4
>
Acked-by: Gustavo F. Padovan <padovan@profusion.mobi>
--
Gustavo F. Padovan
http://padovan.org
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] Bluetooth: Remove double free of skb pointer
2009-12-22 14:56 Andrei Emeltchenko
2010-01-05 22:33 ` Gustavo F. Padovan
@ 2010-01-07 3:47 ` Marcel Holtmann
1 sibling, 0 replies; 5+ messages in thread
From: Marcel Holtmann @ 2010-01-07 3:47 UTC (permalink / raw)
To: Andrei Emeltchenko; +Cc: linux-bluetooth
Hi Andrei,
> Trivial fix for double free of skb pointer with kfree_skb to
> make code simplier and cleaner. Remove unused variable err.
patch has been applied. Thanks.
Regards
Marcel
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2010-01-07 3:47 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2009-12-22 13:29 [PATCH] Bluetooth: Remove double free of skb pointer Andrei Emeltchenko
2009-12-22 13:34 ` Andrei Emeltchenko
-- strict thread matches above, loose matches on Subject: below --
2009-12-22 14:56 Andrei Emeltchenko
2010-01-05 22:33 ` Gustavo F. Padovan
2010-01-07 3:47 ` Marcel Holtmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).