The patch titled
net/bluetooth/rfcomm/tty.c: use-after-free
has been removed from the -mm tree. Its filename was
net-bluetooth-rfcomm-ttyc-use-after-free.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: net/bluetooth/rfcomm/tty.c: use-after-free
From: Marcel Holtmann <marcel@xxxxxxxxxxxx>
Adrian said:
> Commit 8de0a15483b357d0f0b821330ec84d1660cadc4e added the following
> use-after-free in net/bluetooth/rfcomm/tty.c:
>
> <-- snip -->
>
> ...
> static int rfcomm_dev_add(struct rfcomm_dev_req *req, struct rfcomm_dlc *dlc)
> {
> ...
> if (IS_ERR(dev->tty_dev)) {
> list_del(&dev->list);
> kfree(dev);
> return PTR_ERR(dev->tty_dev);
> }
> ...
>
> <-- snip -->
>
> Spotted by the Coverity checker.
Signed-off-by: Marcel Holtmann <marcel@xxxxxxxxxxxx>
Cc: Adrian Bunk <bunk@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
net/bluetooth/rfcomm/tty.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff -puN net/bluetooth/rfcomm/tty.c~net-bluetooth-rfcomm-ttyc-use-after-free net/bluetooth/rfcomm/tty.c
--- a/net/bluetooth/rfcomm/tty.c~net-bluetooth-rfcomm-ttyc-use-after-free
+++ a/net/bluetooth/rfcomm/tty.c
@@ -267,7 +267,7 @@ static int rfcomm_dev_add(struct rfcomm_
out:
write_unlock_bh(&rfcomm_dev_lock);
- if (err) {
+ if (err < 0) {
kfree(dev);
return err;
}
@@ -275,9 +275,10 @@ out:
dev->tty_dev = tty_register_device(rfcomm_tty_driver, dev->id, NULL);
if (IS_ERR(dev->tty_dev)) {
+ err = PTR_ERR(dev->tty_dev);
list_del(&dev->list);
kfree(dev);
- return PTR_ERR(dev->tty_dev);
+ return err;
}
return dev->id;
_
Patches currently in -mm which might be from marcel@xxxxxxxxxxxx are
git-net.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
