Bluetooth: Return RFCOMM session ptrs to avoid freed session
authorDean Jenkins <Dean_Jenkins@mentor.com>
Thu, 28 Feb 2013 14:21:55 +0000 (14:21 +0000)
committerGustavo Padovan <gustavo.padovan@collabora.co.uk>
Fri, 8 Mar 2013 13:40:24 +0000 (10:40 -0300)
commit8ff52f7d04d9cc31f1e81dcf9a2ba6335ed34905
tree681a2468209aff5c83cd7c3bafe1eb6c38123c63
parentc06f7d532aa6f78b2847e3b651c0da27fc3296c0
Bluetooth: Return RFCOMM session ptrs to avoid freed session

Unfortunately, the design retains local copies of the s RFCOMM
session pointer in various code blocks and this invites the erroneous
access to a freed RFCOMM session structure.

Therefore, return the RFCOMM session pointer back up the call stack
to avoid accessing a freed RFCOMM session structure. When the RFCOMM
session is deleted, NULL is passed up the call stack.

If active DLCs exist when the rfcomm session is terminating,
avoid a memory leak of rfcomm_dlc structures by ensuring that
rfcomm_session_close() is used instead of rfcomm_session_del().

Signed-off-by: Dean Jenkins <Dean_Jenkins@mentor.com>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
include/net/bluetooth/rfcomm.h
net/bluetooth/rfcomm/core.c