From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:43252) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XHs8B-0000Ld-S0 for qemu-devel@nongnu.org; Thu, 14 Aug 2014 06:19:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XHs87-0004Nf-Hu for qemu-devel@nongnu.org; Thu, 14 Aug 2014 06:19:39 -0400 Date: Thu, 14 Aug 2014 12:19:52 +0200 From: "Michael S. Tsirkin" Message-ID: <20140814101952.GD31346@redhat.com> References: <1408001361-13580-1-git-send-email-zhang.zhanghailiang@huawei.com> <1408001361-13580-2-git-send-email-zhang.zhanghailiang@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline In-Reply-To: <1408001361-13580-2-git-send-email-zhang.zhanghailiang@huawei.com> Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH v6 01/10] l2cap: fix access freed memory List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: zhanghailiang Cc: kwolf@redhat.com, lkurusa@redhat.com, qemu-trivial@nongnu.org, jan.kiszka@siemens.com, riku.voipio@iki.fi, mjt@tls.msk.ru, qemu-devel@nongnu.org, lcapitulino@redhat.com, stefanha@redhat.com, luonengjun@huawei.com, pbonzini@redhat.com, peter.huangpeng@huawei.com, alex.bennee@linaro.org, rth@twiddle.net On Thu, Aug 14, 2014 at 03:29:12PM +0800, zhanghailiang wrote: > Pointer 'ch' will be used in function 'l2cap_channel_open_req_msg' afte= r > it was previously freed in 'l2cap_channel_open'. > Assigned it to NULL after it is freed. Reviewed-by: Michael S. Tsirkin >=20 > Reviewed-by: Alex Benn=E9e > Signed-off-by: zhanghailiang > --- > hw/bt/l2cap.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) >=20 > diff --git a/hw/bt/l2cap.c b/hw/bt/l2cap.c > index 2301d6f..591e047 100644 > --- a/hw/bt/l2cap.c > +++ b/hw/bt/l2cap.c > @@ -429,7 +429,7 @@ static struct l2cap_chan_s *l2cap_channel_open(stru= ct l2cap_instance_s *l2cap, > status =3D L2CAP_CS_NO_INFO; > } else { > g_free(ch); > - > + ch =3D NULL; > result =3D L2CAP_CR_NO_MEM; > status =3D L2CAP_CS_NO_INFO; > } > --=20 > 1.7.12.4 >=20