* [Patch] Possible double free in net/bluetooth/sco.c
@ 2006-04-04 19:25 Eric Sesterhenn
2006-04-06 5:28 ` David S. Miller
0 siblings, 1 reply; 2+ messages in thread
From: Eric Sesterhenn @ 2006-04-04 19:25 UTC (permalink / raw)
To: LKML; +Cc: maxk
hi,
this fixes coverity bug id #1068.
hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
Since it returns a negative error value only in this case, we
can directly return here.
Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
--- linux-2.6.17-rc1/net/bluetooth/sco.c.orig 2006-04-04 21:19:51.000000000 +0200
+++ linux-2.6.17-rc1/net/bluetooth/sco.c 2006-04-04 21:20:34.000000000 +0200
@@ -255,7 +255,7 @@ static inline int sco_send_frame(struct
}
if ((err = hci_send_sco(conn->hcon, skb)) < 0)
- goto fail;
+ return err;
return count;
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [Patch] Possible double free in net/bluetooth/sco.c
2006-04-04 19:25 [Patch] Possible double free in net/bluetooth/sco.c Eric Sesterhenn
@ 2006-04-06 5:28 ` David S. Miller
0 siblings, 0 replies; 2+ messages in thread
From: David S. Miller @ 2006-04-06 5:28 UTC (permalink / raw)
To: snakebyte; +Cc: linux-kernel, maxk
From: Eric Sesterhenn <snakebyte@gmx.de>
Date: Tue, 04 Apr 2006 21:25:18 +0200
> this fixes coverity bug id #1068.
> hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
> Since it returns a negative error value only in this case, we
> can directly return here.
>
> Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
This looks fine, applied.
Thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-04-06 5:28 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-04-04 19:25 [Patch] Possible double free in net/bluetooth/sco.c Eric Sesterhenn
2006-04-06 5:28 ` David S. Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).