Skip to content

Commit

Permalink
NFC: llcp: Fix usage of llcp_add_tlv()
Browse files Browse the repository at this point in the history
In functions using llcp_add_tlv(), a skb pointer could be set to NULL
and then reuse afterward.

With this patch, the skb pointer returned by llcp_add_tlv() is ignored
since it can only be the passed skb pointer or NULL when the passed TLV
is NULL. There is also no need to check for the TLV pointer as this is
done by llcp_add_tlv().

Signed-off-by: Thierry Escande <thierry.escande@collabora.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
  • Loading branch information
Thierry Escande authored and Samuel Ortiz committed Jul 6, 2016
1 parent 204bddc commit de9e5ae
Showing 1 changed file with 5 additions and 8 deletions.
13 changes: 5 additions & 8 deletions net/nfc/llcp_commands.c
Original file line number Diff line number Diff line change
Expand Up @@ -438,12 +438,9 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
goto error_tlv;
}

if (service_name_tlv != NULL)
skb = llcp_add_tlv(skb, service_name_tlv,
service_name_tlv_length);

skb = llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
skb = llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
llcp_add_tlv(skb, service_name_tlv, service_name_tlv_length);
llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
llcp_add_tlv(skb, rw_tlv, rw_tlv_length);

skb_queue_tail(&local->tx_queue, skb);

Expand Down Expand Up @@ -493,8 +490,8 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
goto error_tlv;
}

skb = llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
skb = llcp_add_tlv(skb, rw_tlv, rw_tlv_length);
llcp_add_tlv(skb, miux_tlv, miux_tlv_length);
llcp_add_tlv(skb, rw_tlv, rw_tlv_length);

skb_queue_tail(&local->tx_queue, skb);

Expand Down

0 comments on commit de9e5ae

Please sign in to comment.