| Message ID | 20231117112833.v2.2.I5f8211e201324f6d9f699e995fc59dda1e51f0ce@changeid |
|---|---|
| State | New |
| Headers | show |
| Series | [v2,1/2] Bluetooth: btusb: Return when coredump trigger cmd fails | expand |
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 35a26440cabd..d23c992502c5 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3531,10 +3531,11 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb) goto out; } - ret = hci_devcd_init(hdev, dump_size); - if (ret < 0) { - bt_dev_err(hdev, "memdump init error(%d)", ret); - goto out; + if (hci_devcd_init(hdev, dump_size) < 0) { + bt_dev_err(hdev, "memdump init error"); + clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags); + kfree_skb(skb); + return ret; } btdata->qca_dump.ram_dump_size = dump_size;
The hci_devcd_init() returns 0 on success. Do not use this return value when eturning from handle_dump_pkt_qca() as it incorrectly indicates that it's not a dump packet. This causes the first dump skb to be processed by both hci_devcd_rx() and hci_recv_frame() leading to double free. Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support") Signed-off-by: Manish Mandlik <mmandlik@google.com> --- (no changes since v1) drivers/bluetooth/btusb.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)