diff options
| author | Johan Hedberg <johan.hedberg@intel.com> | 2013-10-10 13:33:37 +0200 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2013-10-10 05:00:34 -0700 |
| commit | c4e5bafa661126b7b42459ad32d4c2cc589ef8fb (patch) | |
| tree | b0647af6398962acb3532679c71221a37fc6eb6e /include/linux/string_helpers.h | |
| parent | 9ecb3e24258f1ff4b9937602962ae12e3b57f98d (diff) | |
Bluetooth: Fix potential double-frees of L2CAP skbs
The l2cap_recv_frame function is expected to take ownership and
eventually free the skb passed to it. We need to ensure that the
conn->rx_skb pointer is no longer reachable when calling
l2cap_recv_frame so that no other function, such as l2cap_conn_del, may
think that it can free conn->rx_skb.
An actual situation when this can happen is when smp_sig_channel (called
from l2cap_recv_frame) fails and l2cap_conn_del gets called as a
consequence. The l2cap_conn_del function would then try to free
conn->rx_skb, but as the same skb was just passed to smp_sig_channel and
freed we get a double-free.
Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'include/linux/string_helpers.h')
0 files changed, 0 insertions, 0 deletions