diff options
| author |   Szymon Janc <szymon.janc@tieto.com> | 2011-11-16 09:32:19 +0100 |
|---|---|---|
| committer |   Gustavo F. Padovan <padovan@profusion.mobi> | 2011-11-16 18:29:07 -0200 |
| commit | 039d9572f11ef46ff2743798f2170a888d393ec6 (patch) | |
| tree | d838c608e21081416216f7a2f8fdfbc5739a3f47 /net/bluetooth | |
| parent | Bluetooth: Fix possible NULL pointer derefence in l2cap code (diff) | |
| download | linux-dev-039d9572f11ef46ff2743798f2170a888d393ec6.tar.xz linux-dev-039d9572f11ef46ff2743798f2170a888d393ec6.zip | |
Bluetooth: Simplify l2cap_add_to_srej_queue
Make it easier to see what is loop break condition.
skb_queue_next return valid skb or garbage, not NULL.
Signed-off-by: Szymon Janc <szymon.janc@tieto.com>
Signed-off-by: Gustavo F. Padovan <padovan@profusion.mobi>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/l2cap_core.c | 13 |
1 files changed, 5 insertions, 8 deletions
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 276817a90f59..bd65b3e8a1df 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3562,14 +3562,10 @@ static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, bt_cb(skb)->sar = sar; next_skb = skb_peek(&chan->srej_q); - if (!next_skb) { - __skb_queue_tail(&chan->srej_q, skb); - return 0; - } tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq); - do { + while (next_skb) { if (bt_cb(next_skb)->tx_seq == tx_seq) return -EINVAL; @@ -3582,9 +3578,10 @@ static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, } if (skb_queue_is_last(&chan->srej_q, next_skb)) - break; - - } while ((next_skb = skb_queue_next(&chan->srej_q, next_skb))); + next_skb = NULL; + else + next_skb = skb_queue_next(&chan->srej_q, next_skb); + } __skb_queue_tail(&chan->srej_q, skb); |