Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fcafde2e authored by Andrei Emeltchenko's avatar Andrei Emeltchenko Committed by Marcel Holtmann
Browse files

Bluetooth: Remove double free of SKB pointer in L2CAP 



Trivial fix for double free of SKB pointer with kfree_skb to
make code simplier and cleaner. Remove unused variable err.

Signed-off-by: default avatarAndrei Emeltchenko <andrei.emeltchenko@nokia.com>
Acked-by: default avatarGustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent b473946a

net/bluetooth/l2cap.c

+4 −7
Original line number Diff line number Diff line
@@ -3518,7 +3518,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk 
	struct l2cap_pinfo *pi;

	u16 control, len;

	u8 tx_seq;

	int err;



	sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);

	if (!sk) {
@@ -3570,13 +3569,11 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk 
			goto drop;



		if (__is_iframe(control))

			err = l2cap_data_channel_iframe(sk, control, skb);

			l2cap_data_channel_iframe(sk, control, skb);

		else

			err = l2cap_data_channel_sframe(sk, control, skb);

			l2cap_data_channel_sframe(sk, control, skb);



		if (!err)

		goto done;

		break;



	case L2CAP_MODE_STREAMING:

		control = get_unaligned_le16(skb->data);
@@ -3602,7 +3599,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk 
		else

			pi->expected_tx_seq = tx_seq + 1;



		err = l2cap_sar_reassembly_sdu(sk, skb, control);

		l2cap_sar_reassembly_sdu(sk, skb, control);



		goto done;