[PATCH 2/3] attrib: Fix use after free of attrib

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



If attrib is freed in cmd->func(), then it will be used if either
request or response queue has some data to send.

This patch moves calling wake_up_sender() which increases the ref
count of attrib so that it wont get freed in cmd->func().
---
 attrib/gattrib.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/attrib/gattrib.c b/attrib/gattrib.c
index d648b82..0090027 100644
--- a/attrib/gattrib.c
+++ b/attrib/gattrib.c
@@ -450,6 +450,9 @@ done:
 	norequests = g_queue_is_empty(attrib->requests);
 	noresponses = g_queue_is_empty(attrib->responses);
 
+	if (!norequests || !noresponses)
+		wake_up_sender(attrib);
+
 	if (cmd) {
 		if (cmd->func)
 			cmd->func(status, buf, len, cmd->user_data);
@@ -457,9 +460,6 @@ done:
 		command_destroy(cmd);
 	}
 
-	if (!norequests || !noresponses)
-		wake_up_sender(attrib);
-
 	return TRUE;
 }
 
-- 
1.7.9.5

--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html


[Index of Archives]     [Bluez Devel]     [Linux Wireless Networking]     [Linux Wireless Personal Area Networking]     [Linux ATH6KL]     [Linux USB Devel]     [Linux Media Drivers]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux