kernel/linux.git/drivers/bluetooth/btqcomsmd.c, branch v4.9.331Linux kernel stable tree (mirror)https://git.radix-linux.su/kernel/linux.git/atom?h=v4.9.3312018-03-24T10:00:22+00:00Bluetooth: btqcomsmd: Fix skb double free corruption2018-03-24T10:00:22+00:00Loic Poulainloic.poulain@linaro.org2017-11-22T14:03:17+00:00urn:sha1:dadb6c1a8d889b5cab5ff6ed44db9cdb445467e7
[ Upstream commit 67b8fbead4685b36d290a0ef91c6ddffc4920ec9 ]
In case of hci send frame failure, skb is still owned
by the caller (hci_core) and then should not be freed.
This fixes crash on dragonboard-410c when sending SCO
packet. skb is freed by both btqcomsmd and hci_core.
Fixes: 1511cc750c3d ("Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver")
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bluetooth: Introduce Qualcomm WCNSS SMD based HCI driver2016-09-19T18:19:34+00:00Bjorn Anderssonbjorn.andersson@sonymobile.com2016-08-13T00:01:28+00:00urn:sha1:1511cc750c3d9a1c402d71e3522c9cf1fad0ad9c
The Qualcomm WCNSS chip provides two SMD channels to the BT core; one
for command and one for event packets. This driver exposes the two
channels as a hci device.
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>