Hi Luiz,
On Wed, Sep 17, 2014 at 03:49:44PM +0300, Luiz Augusto von Dentz wrote:
> From: Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>
>
> This convert btdev_set_send_handler to take struct iovec for doing
> scatter io.
...
> --- + iov2[1].iov_base = &hdr;
> + iov2[1].iov_len = sizeof(hdr);
>
> - if (run_hooks(btdev, BTDEV_HOOK_POST_CMD, opcode, pkt_data, pkt_len))
> - send_packet(btdev, pkt_data, pkt_len);
> + for (i = 0; i < iovlen; i++) {
> + hdr.plen += iov[i].iov_len;
> + iov2[2 + i].iov_base = iov[i].iov_base;
> + iov2[2 + i].iov_len = iov[i].iov_len;
> + }
>
> - free(pkt_data);
> + if (run_hooks(btdev, BTDEV_HOOK_POST_CMD, opcode, iov[i].iov_base,
> +
> iov[i].iov_len))
This is wrong memory access. i == iovlen here.
Best regards
Andrei Emeltchenko
--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
