| From 5ff28ffd3cba8ab8129841763271dd1401721e7a Mon Sep 17 00:00:00 2001 |
| From: David S. Miller <davem@davemloft.net> |
| Date: Sun, 19 Sep 2010 17:56:19 -0700 |
| Subject: irda: Correctly clean up self->ias_obj on irda_bind() failure. |
| |
| |
| From: David S. Miller <davem@davemloft.net> |
| |
| [ Upstream commit 628e300cccaa628d8fb92aa28cb7530a3d5f2257 ] |
| |
| If irda_open_tsap() fails, the irda_bind() code tries to destroy |
| the ->ias_obj object by hand, but does so wrongly. |
| |
| In particular, it fails to a) release the hashbin attached to the |
| object and b) reset the self->ias_obj pointer to NULL. |
| |
| Fix both problems by using irias_delete_object() and explicitly |
| setting self->ias_obj to NULL, just as irda_release() does. |
| |
| Reported-by: Tavis Ormandy <taviso@cmpxchg8b.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| --- |
| net/irda/af_irda.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/net/irda/af_irda.c |
| +++ b/net/irda/af_irda.c |
| @@ -810,8 +810,8 @@ static int irda_bind(struct socket *sock |
| |
| err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name); |
| if (err < 0) { |
| - kfree(self->ias_obj->name); |
| - kfree(self->ias_obj); |
| + irias_delete_object(self->ias_obj); |
| + self->ias_obj = NULL; |
| return err; |
| } |
| |
