/* * Copyright (C) 2014, Red Hat Inc, Arnaldo Carvalho de Melo * * Released under the GPL v2. (and only v2, not any later version) */ #include "array.h" #include #include #include #include #include void fdarray__init(struct fdarray *fda, int nr_autogrow) { fda->entries = NULL; fda->priv = NULL; fda->nr = fda->nr_alloc = 0; fda->nr_autogrow = nr_autogrow; } int fdarray__grow(struct fdarray *fda, int nr) { void *priv; int nr_alloc = fda->nr_alloc + nr; size_t psize = sizeof(fda->priv[0]) * nr_alloc; size_t size = sizeof(struct pollfd) * nr_alloc; struct pollfd *entries = realloc(fda->entries, size); if (entries == NULL) return -ENOMEM; priv = realloc(fda->priv, psize); if (priv == NULL) { free(entries); return -ENOMEM; } fda->nr_alloc = nr_alloc; fda->entries = entries; fda->priv = priv; return 0; } struct fdarray *fdarray__new(int nr_alloc, int nr_autogrow) { struct fdarray *fda = calloc(1, sizeof(*fda)); if (fda != NULL) { if (fdarray__grow(fda, nr_alloc)) { free(fda); fda = NULL; } else { fda->nr_autogrow = nr_autogrow; } } return fda; } void fdarray__exit(struct fdarray *fda) { free(fda->entries); free(fda->priv); fdarray__init(fda, 0); } void fdarray__delete(struct fdarray *fda) { fdarray__exit(fda); free(fda); } int fdarray__add(struct fdarray *fda, int fd, short revents) { int pos = fda->nr; if (fda->nr == fda->nr_alloc && fdarray__grow(fda, fda->nr_autogrow) < 0) return -ENOMEM; fda->entries[fda->nr].fd = fd; fda->entries[fda->nr].events = revents; fda->nr++; return pos; } int fdarray__filter(struct fdarray *fda, short revents, void (*entry_destructor)(struct fdarray *fda, int fd, void *arg), void *arg) { int fd, nr = 0; if (fda->nr == 0) return 0; for (fd = 0; fd < fda->nr; ++fd) { if (fda->entries[fd].revents & revents) { if (entry_destructor) entry_destructor(fda, fd, arg); continue; } if (fd != nr) { fda->entries[nr] = fda->entries[fd]; fda->priv[nr] = fda->priv[fd]; } ++nr; } return fda->nr = nr; } int fdarray__poll(struct fdarray *fda, int timeout) { return poll(fda->entries, fda->nr, timeout); } int fdarray__fprintf(struct fdarray *fda, FILE *fp) { int fd, printed = fprintf(fp, "%d [ ", fda->nr); for (fd = 0; fd < fda->nr; ++fd) printed += fprintf(fp, "%s%d", fd ? ", " : "", fda->entries[fd].fd); return printed + fprintf(fp, " ]"); } e'/>

path: root/net/bluetooth/rfcomm/tty.c

diff options

author	Dan Carpenter <dan.carpenter@oracle.com>	2017-01-30 10:55:04 +0100
committer	David S. Miller <davem@davemloft.net>	2017-01-30 16:37:55 -0500
commit	cdaf25dfc058ee6f7a7b2e2353de00fa288c0cd4 (patch)
tree	a45096fd9e8aaeea2eac1f1999a3d17dfeb0d02b /net/bluetooth/rfcomm/tty.c
parent	1930b60352e7e195f55b27cde15d2a8f43342a8b (diff)

smc: some potential use after free bugs

Say we got really unlucky and these failed on the last iteration, then it could lead to a use after free bug. Fixes: cd6851f30386 ("smc: remote memory buffers (RMBs)") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com> Signed-off-by: David S. Miller <davem@davemloft.net>

Diffstat (limited to 'net/bluetooth/rfcomm/tty.c')


context:
space:
mode: