diff mbox series

[Bluez] device: fix temporary_timer double free

Message ID 20201020180230.Bluez.1.I67bbd887ee5c0b214a77cb0ed8f9e1d3812ffe73@changeid (mailing list archive)
State Accepted
Delegated to: Luiz Von Dentz
Headers show
Series [Bluez] device: fix temporary_timer double free | expand

Commit Message

Archie Pusaka Oct. 20, 2020, 10:02 a.m. UTC 
From: Archie Pusaka <apusaka@chromium.org>

One instance of freeing temporary_timer is not followed by setting
the variable to 0, causing potential double free.

Reviewed-by: Yun-Hao Chung <howardchung@google.com>
---

 src/device.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

bluez.test.bot@gmail.com Oct. 20, 2020, 10:34 a.m. UTC | #1 
This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=367425

---Test result---

##############################
Test: CheckPatch - PASS

##############################
Test: CheckGitLint - PASS

##############################
Test: CheckBuild - PASS

##############################
Test: MakeCheck - PASS



---
Regards,
Linux Bluetooth
Luiz Augusto von Dentz Oct. 21, 2020, 4:47 p.m. UTC | #2 
Hi Archie,

On Tue, Oct 20, 2020 at 4:30 AM <bluez.test.bot@gmail.com> wrote:
>
> This is automated email and please do not reply to this email!
>
> Dear submitter,
>
> Thank you for submitting the patches to the linux bluetooth mailing list.
> This is a CI test results with your patch series:
> PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=367425
>
> ---Test result---
>
> ##############################
> Test: CheckPatch - PASS
>
> ##############################
> Test: CheckGitLint - PASS
>
> ##############################
> Test: CheckBuild - PASS
>
> ##############################
> Test: MakeCheck - PASS
>
>
>
> ---
> Regards,
> Linux Bluetooth

Applied, thanks.
diff mbox series

Patch

diff --git a/src/device.c b/src/device.c
index a5ef467301..2800b276a2 100644
--- a/src/device.c
+++ b/src/device.c
@@ -4477,8 +4477,10 @@  void device_remove(struct btd_device *device, gboolean remove_stored)
 		disconnect_all(device);
 	}
 
-	if (device->temporary_timer > 0)
+	if (device->temporary_timer > 0) {
 		g_source_remove(device->temporary_timer);
+		device->temporary_timer = 0;
+	}
 
 	if (device->store_id > 0) {
 		g_source_remove(device->store_id);