lkml.org 
[lkml]   [2018]   [Mar]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 05/84] Bluetooth: btqcomsmd: Fix skb double free corruption
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Loic Poulain <loic.poulain@linaro.org>


    [ Upstream commit 67b8fbead4685b36d290a0ef91c6ddffc4920ec9 ]

    In case of hci send frame failure, skb is still owned
    by the caller (hci_core) and then should not be freed.

    This fixes crash on dragonboard-410c when sending SCO
    packet. skb is freed by both btqcomsmd and hci_core.

    Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver")
    Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/bluetooth/btqcomsmd.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/bluetooth/btqcomsmd.c
    +++ b/drivers/bluetooth/btqcomsmd.c
    @@ -88,7 +88,8 @@ static int btqcomsmd_send(struct hci_dev
    break;
    }

    - kfree_skb(skb);
    + if (!ret)
    + kfree_skb(skb);

    return ret;
    }

    \
     
     \ /
      Last update: 2018-03-23 13:17    [W:4.081 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site