Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6187ffd authored by Loic Poulain's avatar Loic Poulain Committed by Marcel Holtmann
Browse files

Bluetooth: btwilink: Fix unexpected skb free 



The caller (hci_core) still owns the skb in case of error, releasing
it inside the send function can lead to use-after-free errors.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarLoic Poulain <loic.poulain@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 823b8420

drivers/bluetooth/btwilink.c

+0 −1
Original line number Diff line number Diff line
@@ -262,7 +262,6 @@ static int ti_st_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 
	pkt_type = hci_skb_pkt_type(skb);

	len = hst->st_write(skb);

	if (len < 0) {

		kfree_skb(skb);

		BT_ERR("ST write failed (%ld)", len);

		/* Try Again, would only fail if UART has gone bad */

		return -EAGAIN;