diff options
| author | Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> | 2012-11-26 08:40:04 +0100 |
|---|---|---|
| committer | Samuel Ortiz <sameo@linux.intel.com> | 2012-11-28 18:42:04 +0100 |
| commit | 289814918ce3af1296ac7d9b05508bde64e97348 (patch) | |
| tree | 3f9177e30161d0ece3bb426c735d122fda71ee3c /net/nfc/llcp | |
| parent | 6bdd253f635f7b2ef027d116933a6c9ec148b87f (diff) | |
NFC: Fix incorrect llcp pointer dereference
nfc_llcp_ns(s) dereferences the s pointer which is freed a line
above. In a result, it can produce a crash or you will read
incorrect value.
Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Diffstat (limited to 'net/nfc/llcp')
| -rw-r--r-- | net/nfc/llcp/llcp.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c index 9e8f4b2801f..3d63636120b 100644 --- a/net/nfc/llcp/llcp.c +++ b/net/nfc/llcp/llcp.c @@ -903,15 +903,18 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local, /* Remove skbs from the pending queue */ if (llcp_sock->send_ack_n != nr) { struct sk_buff *s, *tmp; + u8 n; llcp_sock->send_ack_n = nr; /* Remove and free all skbs until ns == nr */ skb_queue_walk_safe(&llcp_sock->tx_pending_queue, s, tmp) { + n = nfc_llcp_ns(s); + skb_unlink(s, &llcp_sock->tx_pending_queue); kfree_skb(s); - if (nfc_llcp_ns(s) == nr) + if (n == nr) break; } |