aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorMarcel Holtmann <marcel@holtmann.org>2008-10-06 06:22:51 -0400
committerMarcel Holtmann <marcel@holtmann.org>2008-10-06 06:22:51 -0400
commit36010ff6788a058147ae15a1aebf97fd30fa51a9 (patch)
treeebca6f1912cd4424147414120722ada8e737cb52 /drivers
parent94aca1dac6f6d21f4b07e4864baf7768cabcc6e7 (diff)
[Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers
The transfer buffer of an URB will be automatically freed when using the URB_FREE_BUFFER transfer_flag. So the extra calls to kfree() will cause a double free. Reported-by: Justin Mattock <justinmattock@gmail.com> Signed-off-by: Rabin Vincent <rabin@rab.in> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/bluetooth/bpa10x.c2
-rw-r--r--drivers/bluetooth/btusb.c3
2 files changed, 0 insertions, 5 deletions
diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c
index 1e55a658e6ce..32f3a8ed8d3d 100644
--- a/drivers/bluetooth/bpa10x.c
+++ b/drivers/bluetooth/bpa10x.c
@@ -256,7 +256,6 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
256 BT_ERR("%s urb %p submission failed (%d)", 256 BT_ERR("%s urb %p submission failed (%d)",
257 hdev->name, urb, -err); 257 hdev->name, urb, -err);
258 usb_unanchor_urb(urb); 258 usb_unanchor_urb(urb);
259 kfree(buf);
260 } 259 }
261 260
262 usb_free_urb(urb); 261 usb_free_urb(urb);
@@ -298,7 +297,6 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
298 BT_ERR("%s urb %p submission failed (%d)", 297 BT_ERR("%s urb %p submission failed (%d)",
299 hdev->name, urb, -err); 298 hdev->name, urb, -err);
300 usb_unanchor_urb(urb); 299 usb_unanchor_urb(urb);
301 kfree(buf);
302 } 300 }
303 301
304 usb_free_urb(urb); 302 usb_free_urb(urb);
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 29ae99817c60..262e9bebebc9 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -271,7 +271,6 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev)
271 BT_ERR("%s urb %p submission failed (%d)", 271 BT_ERR("%s urb %p submission failed (%d)",
272 hdev->name, urb, -err); 272 hdev->name, urb, -err);
273 usb_unanchor_urb(urb); 273 usb_unanchor_urb(urb);
274 kfree(buf);
275 } 274 }
276 275
277 usb_free_urb(urb); 276 usb_free_urb(urb);
@@ -354,7 +353,6 @@ static int btusb_submit_bulk_urb(struct hci_dev *hdev)
354 BT_ERR("%s urb %p submission failed (%d)", 353 BT_ERR("%s urb %p submission failed (%d)",
355 hdev->name, urb, -err); 354 hdev->name, urb, -err);
356 usb_unanchor_urb(urb); 355 usb_unanchor_urb(urb);
357 kfree(buf);
358 } 356 }
359 357
360 usb_free_urb(urb); 358 usb_free_urb(urb);
@@ -475,7 +473,6 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev)
475 BT_ERR("%s urb %p submission failed (%d)", 473 BT_ERR("%s urb %p submission failed (%d)",
476 hdev->name, urb, -err); 474 hdev->name, urb, -err);
477 usb_unanchor_urb(urb); 475 usb_unanchor_urb(urb);
478 kfree(buf);
479 } 476 }
480 477
481 usb_free_urb(urb); 478 usb_free_urb(urb);