2009-12-22 14:56:17

by Andrei Emeltchenko

[permalink] [raw]
Subject: [PATCH] Bluetooth: Remove double free of skb pointer

Trivial fix for double free of skb pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.

Signed-off-by: Andrei Emeltchenko <[email protected]>
---
net/bluetooth/l2cap.c | 11 ++++-------
1 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf1..8acc19e 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -3518,7 +3518,6 @@ static inline int l2cap_data_channel(struct
l2cap_conn *conn, u16 cid, struct sk
struct l2cap_pinfo *pi;
u16 control, len;
u8 tx_seq;
- int err;

sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
if (!sk) {
@@ -3570,13 +3569,11 @@ static inline int l2cap_data_channel(struct
l2cap_conn *conn, u16 cid, struct sk
goto drop;

if (__is_iframe(control))
- err = l2cap_data_channel_iframe(sk, control, skb);
+ l2cap_data_channel_iframe(sk, control, skb);
else
- err = l2cap_data_channel_sframe(sk, control, skb);
+ l2cap_data_channel_sframe(sk, control, skb);

- if (!err)
- goto done;
- break;
+ goto done;

case L2CAP_MODE_STREAMING:
control = get_unaligned_le16(skb->data);
@@ -3602,7 +3599,7 @@ static inline int l2cap_data_channel(struct
l2cap_conn *conn, u16 cid, struct sk
else
pi->expected_tx_seq = tx_seq + 1;

- err = l2cap_sar_reassembly_sdu(sk, skb, control);
+ l2cap_sar_reassembly_sdu(sk, skb, control);

goto done;

--
1.6.0.4

Attachments:
0001-Bluetooth-Remove-double-free-of-skb-pointer.patch (1.64 kB)

2009-12-22 13:34:25

by Andrei Emeltchenko

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: Remove double free of skb pointer

I will resend it shortly. Sorry.

On Tue, Dec 22, 2009 at 3:29 PM, Andrei Emeltchenko
<[email protected]> wrote:
> From: Andrei Emeltchenko <[email protected]>
>
> Trivial fix for double free of skb pointer with kfree_skb to
> make code simplier and cleaner.
>
> skb is already freed within l2cap_data_channel_iframe function.
>
> Signed-off-by: Andrei Emeltchenko <[email protected]>
> ---
> ?net/bluetooth/l2cap.c | ? ?4 +---
> ?1 files changed, 1 insertions(+), 3 deletions(-)
>
> diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
> index 1120cf1..9584b97 100644
> --- a/net/bluetooth/l2cap.c
> +++ b/net/bluetooth/l2cap.c
> @@ -3574,9 +3574,7 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> ? ? ? ? ? ? ? ?else
> ? ? ? ? ? ? ? ? ? ? ? ?err = l2cap_data_channel_sframe(sk, control, skb);
>
> - ? ? ? ? ? ? ? if (!err)
> - ? ? ? ? ? ? ? ? ? ? ? goto done;
> - ? ? ? ? ? ? ? break;
> + ? ? ? ? ? ? ? goto done;
>
> ? ? ? ?case L2CAP_MODE_STREAMING:
> ? ? ? ? ? ? ? ?control = get_unaligned_le16(skb->data);
> --
> 1.6.0.4
>

2010-01-07 03:47:38

by Marcel Holtmann

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: Remove double free of skb pointer

Hi Andrei,

> Trivial fix for double free of skb pointer with kfree_skb to
> make code simplier and cleaner. Remove unused variable err.

patch has been applied. Thanks.

Regards

Marcel



2010-01-05 22:33:07

by Gustavo F. Padovan

[permalink] [raw]
Subject: Re: [PATCH] Bluetooth: Remove double free of skb pointer

On Tue, Dec 22, 2009 at 12:56 PM, Andrei Emeltchenko
<[email protected]> wrote:
> Trivial fix for double free of skb pointer with kfree_skb to
> make code simplier and cleaner. Remove unused variable err.
>
> Signed-off-by: Andrei Emeltchenko <[email protected]>
> ---
> ?net/bluetooth/l2cap.c | ? 11 ++++-------
> ?1 files changed, 4 insertions(+), 7 deletions(-)
>
> diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
> index 1120cf1..8acc19e 100644
> --- a/net/bluetooth/l2cap.c
> +++ b/net/bluetooth/l2cap.c
> @@ -3518,7 +3518,6 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> ? ? ? ?struct l2cap_pinfo *pi;
> ? ? ? ?u16 control, len;
> ? ? ? ?u8 tx_seq;
> - ? ? ? int err;
>
> ? ? ? ?sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
> ? ? ? ?if (!sk) {
> @@ -3570,13 +3569,11 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> ? ? ? ? ? ? ? ? ? ? ? ?goto drop;
>
> ? ? ? ? ? ? ? ?if (__is_iframe(control))
> - ? ? ? ? ? ? ? ? ? ? ? err = l2cap_data_channel_iframe(sk, control, skb);
> + ? ? ? ? ? ? ? ? ? ? ? l2cap_data_channel_iframe(sk, control, skb);
> ? ? ? ? ? ? ? ?else
> - ? ? ? ? ? ? ? ? ? ? ? err = l2cap_data_channel_sframe(sk, control, skb);
> + ? ? ? ? ? ? ? ? ? ? ? l2cap_data_channel_sframe(sk, control, skb);
>
> - ? ? ? ? ? ? ? if (!err)
> - ? ? ? ? ? ? ? ? ? ? ? goto done;
> - ? ? ? ? ? ? ? break;
> + ? ? ? ? ? ? ? goto done;
>
> ? ? ? ?case L2CAP_MODE_STREAMING:
> ? ? ? ? ? ? ? ?control = get_unaligned_le16(skb->data);
> @@ -3602,7 +3599,7 @@ static inline int l2cap_data_channel(struct
> l2cap_conn *conn, u16 cid, struct sk
> ? ? ? ? ? ? ? ?else
> ? ? ? ? ? ? ? ? ? ? ? ?pi->expected_tx_seq = tx_seq + 1;
>
> - ? ? ? ? ? ? ? err = l2cap_sar_reassembly_sdu(sk, skb, control);
> + ? ? ? ? ? ? ? l2cap_sar_reassembly_sdu(sk, skb, control);
>
> ? ? ? ? ? ? ? ?goto done;
>
> --
> 1.6.0.4
>


Acked-by: Gustavo F. Padovan <[email protected]>



--
Gustavo F. Padovan
http://padovan.org