xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync

Browse Source 
[ Upstream commit 3e5f2d90c28f9454e421108554707620bc23269d ]

bdev->evt_skb will get freed in the normal path and one error path
of mtk_hci_wmt_sync, while the other error paths do not free it,
which may cause a memleak. This bug is suggested by a static analysis
tool, please advise.

Fixes: e0b67035a9 ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dinghao Liu
2021-09-22 21:49:45 +08:00
committed by Greg Kroah-Hartman
parent 310f581f54
commit f0b40bf3e4
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/bluetooth/btmtkuart.c
View File

@@ -158,8 +158,10 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
int err; int err;
hlen = sizeof(*hdr) + wmt_params->dlen; hlen = sizeof(*hdr) + wmt_params->dlen;
if (hlen > 255) if (hlen > 255) {
return -EINVAL; err = -EINVAL;
goto err_free_skb;
}
hdr = (struct mtk_wmt_hdr *)&wc; hdr = (struct mtk_wmt_hdr *)&wc;
hdr->dir = 1; hdr->dir = 1;
@@ -173,7 +175,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc); err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc);
if (err < 0) { if (err < 0) {
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
return err; goto err_free_skb;
} }
/* The vendor specific WMT commands are all answered by a vendor /* The vendor specific WMT commands are all answered by a vendor
@@ -190,13 +192,14 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
if (err == -EINTR) { if (err == -EINTR) {
bt_dev_err(hdev, "Execution of wmt command interrupted"); bt_dev_err(hdev, "Execution of wmt command interrupted");
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
return err; goto err_free_skb;
} }
if (err) { if (err) {
bt_dev_err(hdev, "Execution of wmt command timed out"); bt_dev_err(hdev, "Execution of wmt command timed out");
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
return -ETIMEDOUT; err = -ETIMEDOUT;
goto err_free_skb;
} }
/* Parse and handle the return WMT event */ /* Parse and handle the return WMT event */