[IRDA]: Fix rfcomm use-after-free

[pandora-kernel.git] / drivers / bluetooth / btuart_cs.c

diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index c1bce75..d7d2ea0 100644 (file)
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -250,20 +250,20 @@ static void btuart_receive(btuart_info_t *info)
                                switch (info->rx_state) {
 
                                case RECV_WAIT_EVENT_HEADER:
-                                       eh = (struct hci_event_hdr *)(info->rx_skb->data);
+                                       eh = hci_event_hdr(info->rx_skb);
                                        info->rx_state = RECV_WAIT_DATA;
                                        info->rx_count = eh->plen;
                                        break;
 
                                case RECV_WAIT_ACL_HEADER:
-                                       ah = (struct hci_acl_hdr *)(info->rx_skb->data);
+                                       ah = hci_acl_hdr(info->rx_skb);
                                        dlen = __le16_to_cpu(ah->dlen);
                                        info->rx_state = RECV_WAIT_DATA;
                                        info->rx_count = dlen;
                                        break;
 
                                case RECV_WAIT_SCO_HEADER:
-                                       sh = (struct hci_sco_hdr *)(info->rx_skb->data);
+                                       sh = hci_sco_hdr(info->rx_skb);
                                        info->rx_state = RECV_WAIT_DATA;
                                        info->rx_count = sh->dlen;
                                        break;