mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 23:27:06 +00:00
Bluetooth: btwilink: Fix unexpected skb free
The caller (hci_core) still owns the skb in case of error, releasing it inside the send function can lead to use-after-free errors. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Loic Poulain <loic.poulain@intel.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
parent
823b84201f
commit
a6187ffdfc
1 changed files with 0 additions and 1 deletions
|
@ -262,7 +262,6 @@ static int ti_st_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
|
||||||
pkt_type = hci_skb_pkt_type(skb);
|
pkt_type = hci_skb_pkt_type(skb);
|
||||||
len = hst->st_write(skb);
|
len = hst->st_write(skb);
|
||||||
if (len < 0) {
|
if (len < 0) {
|
||||||
kfree_skb(skb);
|
|
||||||
BT_ERR("ST write failed (%ld)", len);
|
BT_ERR("ST write failed (%ld)", len);
|
||||||
/* Try Again, would only fail if UART has gone bad */
|
/* Try Again, would only fail if UART has gone bad */
|
||||||
return -EAGAIN;
|
return -EAGAIN;
|
||||||
|
|
Loading…
Reference in a new issue