The patch titled net/bluetooth/rfcomm/tty.c: use-after-free has been removed from the -mm tree. Its filename was net-bluetooth-rfcomm-ttyc-use-after-free.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ Subject: net/bluetooth/rfcomm/tty.c: use-after-free From: Marcel Holtmann <marcel@xxxxxxxxxxxx> Adrian said: > Commit 8de0a15483b357d0f0b821330ec84d1660cadc4e added the following > use-after-free in net/bluetooth/rfcomm/tty.c: > > <-- snip --> > > ... > static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc) > { > ... > if (IS_ERR(dev->tty_dev)) { > list_del(&dev->list); > kfree(dev); > return PTR_ERR(dev->tty_dev); > } > ... > > <-- snip --> > > Spotted by the Coverity checker. Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx> Cc: Adrian Bunk <bunk@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- net/bluetooth/rfcomm/tty.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff -puN net/bluetooth/rfcomm/tty.c~net-bluetooth-rfcomm-ttyc-use-after-free net/bluetooth/rfcomm/tty.c --- a/net/bluetooth/rfcomm/tty.c~net-bluetooth-rfcomm-ttyc-use-after-free +++ a/net/bluetooth/rfcomm/tty.c @@ -267,7 +267,7 @@ static int rfcomm_dev_add(struct rfcomm_ out: write_unlock_bh(&rfcomm_dev_lock); - if (err) { + if (err < 0) { kfree(dev); return err; } @@ -275,9 +275,10 @@ out: dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL); if (IS_ERR(dev->tty_dev)) { + err = PTR_ERR(dev->tty_dev); list_del(&dev->list); kfree(dev); - return PTR_ERR(dev->tty_dev); + return err; } return dev->id; _ Patches currently in -mm which might be from marcel@xxxxxxxxxxxx are git-net.patch - To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html