diff options
| author | Dinghao Liu <dinghao.liu@zju.edu.cn> | 2021-09-22 21:49:45 +0800 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2021-09-22 16:15:54 +0200 |
| commit | 3e5f2d90c28f9454e421108554707620bc23269d (patch) | |
| tree | 81cadf1ef5deff23807adf63aec496c398b79783 /drivers/bluetooth/btmtkuart.c | |
| parent | c05731d0c6bd9a625e27ea5c5157ebf1303229e0 (diff) | |
| download | linux-stable-3e5f2d90c28f9454e421108554707620bc23269d.tar.gz linux-stable-3e5f2d90c28f9454e421108554707620bc23269d.tar.bz2 linux-stable-3e5f2d90c28f9454e421108554707620bc23269d.zip | |
Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
bdev->evt_skb will get freed in the normal path and one error path
of mtk_hci_wmt_sync, while the other error paths do not free it,
which may cause a memleak. This bug is suggested by a static analysis
tool, please advise.
Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'drivers/bluetooth/btmtkuart.c')
| -rw-r--r-- | drivers/bluetooth/btmtkuart.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c index e9d91d7c0db4..9ba22b13b4fa 100644 --- a/drivers/bluetooth/btmtkuart.c +++ b/drivers/bluetooth/btmtkuart.c @@ -158,8 +158,10 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, int err; hlen = sizeof(*hdr) + wmt_params->dlen; - if (hlen > 255) - return -EINVAL; + if (hlen > 255) { + err = -EINVAL; + goto err_free_skb; + } hdr = (struct mtk_wmt_hdr *)&wc; hdr->dir = 1; @@ -173,7 +175,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc); if (err < 0) { clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); - return err; + goto err_free_skb; } /* The vendor specific WMT commands are all answered by a vendor @@ -190,13 +192,14 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, if (err == -EINTR) { bt_dev_err(hdev, "Execution of wmt command interrupted"); clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); - return err; + goto err_free_skb; } if (err) { bt_dev_err(hdev, "Execution of wmt command timed out"); clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state); - return -ETIMEDOUT; + err = -ETIMEDOUT; + goto err_free_skb; } /* Parse and handle the return WMT event */ |