Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 555fe573 authored by Dinghao Liu's avatar Dinghao Liu Committed by Greg Kroah-Hartman
Browse files

Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync 



[ Upstream commit 3e5f2d90c28f9454e421108554707620bc23269d ]

bdev->evt_skb will get freed in the normal path and one error path
of mtk_hci_wmt_sync, while the other error paths do not free it,
which may cause a memleak. This bug is suggested by a static analysis
tool, please advise.

Fixes: e0b67035 ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 8c68d12f

drivers/bluetooth/btmtkuart.c

+8 −5
Original line number Diff line number Diff line
@@ -158,8 +158,10 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, 
	int err;



	hlen = sizeof(*hdr) + wmt_params->dlen;

	if (hlen > 255)

		return -EINVAL;

	if (hlen > 255) {

		err = -EINVAL;

		goto err_free_skb;

	}



	hdr = (struct mtk_wmt_hdr *)&wc;

	hdr->dir = 1;
@@ -173,7 +175,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, 
	err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc);

	if (err < 0) {

		clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);

		return err;

		goto err_free_skb;

	}



	/* The vendor specific WMT commands are all answered by a vendor
@@ -190,13 +192,14 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, 
	if (err == -EINTR) {

		bt_dev_err(hdev, "Execution of wmt command interrupted");

		clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);

		return err;

		goto err_free_skb;

	}



	if (err) {

		bt_dev_err(hdev, "Execution of wmt command timed out");

		clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);

		return -ETIMEDOUT;

		err = -ETIMEDOUT;

		goto err_free_skb;

	}



	/* Parse and handle the return WMT event */