diff options
| author | Marcel Holtmann <marcel@holtmann.org> | 2008-10-06 12:22:51 +0200 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2008-10-06 12:22:51 +0200 |
| commit | 36010ff6788a058147ae15a1aebf97fd30fa51a9 (patch) | |
| tree | ebca6f1912cd4424147414120722ada8e737cb52 | |
| parent | Linux 2.6.27-rc8 (diff) | |
| download | linux-36010ff6788a058147ae15a1aebf97fd30fa51a9.tar.xz linux-36010ff6788a058147ae15a1aebf97fd30fa51a9.zip | |
[Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers
The transfer buffer of an URB will be automatically freed when using
the URB_FREE_BUFFER transfer_flag. So the extra calls to kfree() will
cause a double free.
Reported-by: Justin Mattock <justinmattock@gmail.com>
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
| -rw-r--r-- | drivers/bluetooth/bpa10x.c | 2 | ||||
| -rw-r--r-- | drivers/bluetooth/btusb.c | 3 |
2 files changed, 0 insertions, 5 deletions
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c index 1e55a658e6ce..32f3a8ed8d3d 100644 --- a/drivers/bluetooth/bpa10x.c +++ b/drivers/bluetooth/bpa10x.c @@ -256,7 +256,6 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); @@ -298,7 +297,6 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 29ae99817c60..262e9bebebc9 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -271,7 +271,6 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); @@ -354,7 +353,6 @@ static int btusb_submit_bulk_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); @@ -475,7 +473,6 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); |