imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-11-11 20:09:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: Never deallocate a session when some DLC points to it

Browse Source 
Fix a bug introduced in commit 9cf5b0ea3a:
function rfcomm_recv_ua calls rfcomm_session_put without checking that
the session is not referenced by some DLC. If the session is freed, that
DLC would refer to deallocated memory, causing an oops later, as shown
in this bug report: https://bugzilla.kernel.org/show_bug.cgi?id=15994

Signed-off-by: Lukas Turek <[email protected]>
Signed-off-by: Gustavo F. Padovan <[email protected]>
This commit is contained in:
Lukáš Turek authored and Gustavo F. Padovan committed 2011-01-19 14:40:42 -02:00
1 parent e2e0cacbd4
commit 683d949a7f
1 file changed
+2 -1
Download Patch File Download Diff File Expand all files Collapse all files
net/bluetooth/rfcomm/core.c
+2 -1
View File
@@ -1164,7 +1164,8 @@ static int rfcomm_recv_ua(struct rfcomm_session *s, u8 dlci)
* initiator rfcomm_process_rx already calls
* rfcomm_session_put() */
if (s->sock->sk->sk_state != BT_CLOSED)
rfcomm_session_put(s);
if (list_empty(&s->dlcs))
rfcomm_session_put(s);
break;
}
}