| Message ID | ca2b3447d110874d90e93c6ddf972f4ad2bc70f9.1706917839.git.objelf@gmail.com |
|---|---|
| State | New |
| Headers | show |
| Series | Bluetooth: btusb: medaitek: fix double free of skb in coredump | expand |
<sean.wang@mediatek.com> writes: > From: Sean Wang <sean.wang@mediatek.com> > > hci_devcd_append() would free the skb on error so the caller don't > have to free it again otherwise it would cause the double free of skb. > > Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support") > Reported-by : Dan Carpenter <dan.carpenter@linaro.org> > Signed-off-by: Sean Wang <sean.wang@mediatek.com> > --- > drivers/bluetooth/btmtk.c | 7 +++---- > 1 file changed, 3 insertions(+), 4 deletions(-) This should be sent to the bluetooth list.
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index aaabb732082c..e882613036a0 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -378,8 +378,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) switch (data->cd_info.state) { case HCI_DEVCOREDUMP_IDLE: err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE); - if (err < 0) + if (err < 0) { + kfree_skb(skb); break; + } data->cd_info.cnt = 0; /* It is supposed coredump can be done within 5 seconds */ @@ -405,9 +407,6 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) break; } - if (err < 0) - kfree_skb(skb); - return err; } EXPORT_SYMBOL_GPL(btmtk_process_coredump);