summaryrefslogtreecommitdiff
path: root/net/nfc
diff options
context:
space:
mode:
authorWaldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com>2012-11-26 08:40:04 +0100
committerSamuel Ortiz <sameo@linux.intel.com>2012-11-28 18:42:04 +0100
commit289814918ce3af1296ac7d9b05508bde64e97348 (patch)
tree3f9177e30161d0ece3bb426c735d122fda71ee3c /net/nfc
parent6bdd253f635f7b2ef027d116933a6c9ec148b87f (diff)
NFC: Fix incorrect llcp pointer dereference
nfc_llcp_ns(s) dereferences the s pointer which is freed a line above. In a result, it can produce a crash or you will read incorrect value. Signed-off-by: Waldemar Rymarkiewicz <waldemar.rymarkiewicz@tieto.com> Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
Diffstat (limited to 'net/nfc')
-rw-r--r--net/nfc/llcp/llcp.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 9e8f4b2801f6..3d63636120b1 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -903,15 +903,18 @@ static void nfc_llcp_recv_hdlc(struct nfc_llcp_local *local,
/* Remove skbs from the pending queue */
if (llcp_sock->send_ack_n != nr) {
struct sk_buff *s, *tmp;
+ u8 n;
llcp_sock->send_ack_n = nr;
/* Remove and free all skbs until ns == nr */
skb_queue_walk_safe(&llcp_sock->tx_pending_queue, s, tmp) {
+ n = nfc_llcp_ns(s);
+
skb_unlink(s, &llcp_sock->tx_pending_queue);
kfree_skb(s);
- if (nfc_llcp_ns(s) == nr)
+ if (n == nr)
break;
}