Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 835a6a2f authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by Marcel Holtmann
Browse files

Bluetooth: Stop sabotaging list poisoning 



list_del() poisons pointers with special values, no need to overwrite them.

Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent d446278c

net/bluetooth/l2cap_core.c

+2 −6
Original line number Original line Diff line number Diff line
@@ -1601,7 +1601,7 @@ int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user) 




	hci_dev_lock(hdev);

	hci_dev_lock(hdev);





	if (user->list.next || user->list.prev) {

	if (!list_empty(&user->list)) {

		ret = -EINVAL;

		ret = -EINVAL;

		goto out_unlock;

		goto out_unlock;

	}

	}
@@ -1631,12 +1631,10 @@ void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user) 




	hci_dev_lock(hdev);

	hci_dev_lock(hdev);





	if (!user->list.next || !user->list.prev)

	if (list_empty(&user->list))

		goto out_unlock;

		goto out_unlock;





	list_del(&user->list);

	list_del(&user->list);

	user->list.next = NULL;

	user->list.prev = NULL;

	user->remove(conn, user);

	user->remove(conn, user);





out_unlock:

out_unlock:
@@ -1651,8 +1649,6 @@ static void l2cap_unregister_all_users(struct l2cap_conn *conn) 
	while (!list_empty(&conn->users)) {

	while (!list_empty(&conn->users)) {

		user = list_first_entry(&conn->users, struct l2cap_user, list);

		user = list_first_entry(&conn->users, struct l2cap_user, list);

		list_del(&user->list);

		list_del(&user->list);

		user->list.next = NULL;

		user->list.prev = NULL;

		user->remove(conn, user);

		user->remove(conn, user);

	}

	}

}

}