net: bt: Fix memory corruption
Patch 235118245864491a592245f57e5244bf61711943 did not set the ll addresses in the right buffer which causes 6lo to unref buffers causing a double unref latter. Jira: ZEP-1890 Change-Id: Id7591ef3c20c7ab62dcb04576406d70602baa129 Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
parent
b1d73aaa98
commit
50ec0864c6
1 changed files with 2 additions and 2 deletions
|
@ -183,12 +183,12 @@ static void ipsp_recv(struct bt_l2cap_chan *chan, struct net_buf *buf)
|
|||
/* Set destination address */
|
||||
net_nbuf_ll_dst(nbuf)->addr = ctxt->src.val;
|
||||
net_nbuf_ll_dst(nbuf)->len = sizeof(ctxt->src);
|
||||
net_nbuf_ll_dst(buf)->type = NET_LINK_BLUETOOTH;
|
||||
net_nbuf_ll_dst(nbuf)->type = NET_LINK_BLUETOOTH;
|
||||
|
||||
/* Set source address */
|
||||
net_nbuf_ll_src(nbuf)->addr = ctxt->dst.val;
|
||||
net_nbuf_ll_src(nbuf)->len = sizeof(ctxt->dst);
|
||||
net_nbuf_ll_src(buf)->type = NET_LINK_BLUETOOTH;
|
||||
net_nbuf_ll_src(nbuf)->type = NET_LINK_BLUETOOTH;
|
||||
|
||||
/* Add data buffer as fragment of RX buffer, take a reference while
|
||||
* doing so since L2CAP will unref the buffer after return.
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue