path: root/drivers
diff options
authorLoic Poulain <loic.poulain@linaro.org>2017-11-22 15:03:17 +0100
committerMarcel Holtmann <marcel@holtmann.org>2017-12-13 00:28:41 +0100
commit67b8fbead4685b36d290a0ef91c6ddffc4920ec9 (patch)
tree673a8729ad350b8f27384d9ca8ae9045e607ad35 /drivers
parentd73e172816652772114827abaa2dbc053eecbbd7 (diff)
Bluetooth: btqcomsmd: Fix skb double free corruption
In case of hci send frame failure, skb is still owned by the caller (hci_core) and then should not be freed. This fixes crash on dragonboard-410c when sending SCO packet. skb is freed by both btqcomsmd and hci_core. Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver") Signed-off-by: Loic Poulain <loic.poulain@linaro.org> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers')
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c
index 663bed63b871..2c9a5fc9137d 100644
--- a/drivers/bluetooth/btqcomsmd.c
+++ b/drivers/bluetooth/btqcomsmd.c
@@ -88,7 +88,8 @@ static int btqcomsmd_send(struct hci_dev *hdev, struct sk_buff *skb)
- kfree_skb(skb);
+ if (!ret)
+ kfree_skb(skb);
return ret;

Privacy Policy