[Patch] Possible double free in net/bluetooth/sco.c

hi,

this fixes coverity bug id #1068. 
hci_send_sco() frees skb if (skb->len > hdev->sco_mtu).
Since it returns a negative error value only in this case, we
can directly return here.

Signed-off-by: Eric Sesterhenn <[email protected]>

--- linux-2.6.17-rc1/net/bluetooth/sco.c.orig	2006-04-04 21:19:51.000000000 +0200
+++ linux-2.6.17-rc1/net/bluetooth/sco.c	2006-04-04 21:20:34.000000000 +0200
@@ -255,7 +255,7 @@ static inline int sco_send_frame(struct 
 	}
 
 	if ((err = hci_send_sco(conn->hcon, skb)) < 0)
-		goto fail;
+		return err;
 
 	return count;
 


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

---

• Follow-Ups:
  • Re: [Patch] Possible double free in net/bluetooth/sco.c
    • From: "David S. Miller" <[email protected]>

• Prev by Date: [PATCH] MPBL0010 driver sysfs permissions wide open
• Next by Date: Re: 2.6.17-rc1-mm1: KEXEC became SMP-only
• Previous by thread: [PATCH] MPBL0010 driver sysfs permissions wide open
• Next by thread: Re: [Patch] Possible double free in net/bluetooth/sco.c
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]