]> git.baikalelectronics.ru Git - kernel.git/commit
Bluetooth: Never deallocate a session when some DLC points to it
authorLukáš Turek <8an@praha12.net>
Wed, 5 Jan 2011 01:43:59 +0000 (02:43 +0100)
committerGustavo F. Padovan <padovan@profusion.mobi>
Wed, 19 Jan 2011 16:40:42 +0000 (14:40 -0200)
commite7e7737dee816348f004c4018ed950c6b064690b
treefafa2f5c18d72466e859e7ade3f6a84d84bb7224
parentdd13d8156e07c9bdfb7133b1e1b1fd5dc73ee117
Bluetooth: Never deallocate a session when some DLC points to it

Fix a bug introduced in commit 22b66ba18798a9e478f65257861f6d0d2dc5eb78:
function rfcomm_recv_ua calls rfcomm_session_put without checking that
the session is not referenced by some DLC. If the session is freed, that
DLC would refer to deallocated memory, causing an oops later, as shown
in this bug report: https://bugzilla.kernel.org/show_bug.cgi?id=15994

Signed-off-by: Lukas Turek <8an@praha12.net>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
net/bluetooth/rfcomm/core.c