[PATCH] Bluetooth: btmtk: fix skb double free on ISO padding failure

[PATCH] Bluetooth: btmtk: fix skb double free on ISO padding failure

[Eric Dumazet]

btmtk_isopkt_pad() uses skb_pad(), which frees the skb on failure.

The error is propagated by alloc_mtk_intr_urb() and
btusb_send_frame_mtk() up to hci_send_frame(), which frees
the skb a second time:

	err = hdev->send(hdev, skb);
	if (err < 0) {
		bt_dev_err(hdev, "sending frame failed (%d)", err);
		kfree_skb(skb);
		return err;
	}

Use __skb_put_padto(skb, MTK_ISO_THRESHOLD, false) so that the skb
is left to the caller on error. This also replaces the open-coded
skb_pad() + __skb_put() sequence.

Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 drivers/bluetooth/btmtk.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 7ea8bcd8a7ecaa0122d96cc3787307301401e00f..c9175d478a9845bd476ad998815429d2748b78f2 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -1023,12 +1023,8 @@ static int btmtk_isopkt_pad(struct hci_dev *hdev, struct sk_buff *skb)
 	if (skb->len > MTK_ISO_THRESHOLD)
 		return -EINVAL;
 
-	if (skb_pad(skb, MTK_ISO_THRESHOLD - skb->len))
-		return -ENOMEM;
-
-	__skb_put(skb, MTK_ISO_THRESHOLD - skb->len);
-
-	return 0;
+	/* On error, the skb is freed by hci_send_frame(). */
+	return __skb_put_padto(skb, MTK_ISO_THRESHOLD, false);
 }
 
 static int __set_mtk_intr_interface(struct hci_dev *hdev)
-- 
2.53.0

RE: Bluetooth: btmtk: fix skb double free on ISO padding failure

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1595 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/series/1182204/

---Test result---

Test Summary:
CheckPatch                    PASS      0.74 seconds
VerifyFixes                   PASS      0.12 seconds
VerifySignedoff               PASS      0.12 seconds
GitLint                       FAIL      0.33 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      29.62 seconds
CheckAllWarning               PASS      34.12 seconds
CheckSparse                   PASS      37.03 seconds
BuildKernel32                 PASS      29.84 seconds
CheckKernelLLVM               PASS      36.04 seconds
TestRunnerSetup               PASS      817.51 seconds
IncrementalBuild              PASS      29.71 seconds

Details
##############################
Test: GitLint - FAIL
Desc: Run gitlint
Output:
Bluetooth: btmtk: fix skb double free on ISO padding failure

9: B3 Line contains hard tab characters (\t): "	err = hdev->send(hdev, skb);"
10: B3 Line contains hard tab characters (\t): "	if (err < 0) {"
11: B3 Line contains hard tab characters (\t): "		bt_dev_err(hdev, "sending frame failed (%d)", err);"
12: B3 Line contains hard tab characters (\t): "		kfree_skb(skb);"
13: B3 Line contains hard tab characters (\t): "		return err;"
14: B3 Line contains hard tab characters (\t): "	}"


https://github.com/bluez/bluetooth-next/pull/892

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btmtk: fix skb double free on ISO padding failure

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri,  9 Oct 2026 10:35:25 +0200 you wrote:
> btmtk_isopkt_pad() uses skb_pad(), which frees the skb on failure.
> 
> The error is propagated by alloc_mtk_intr_urb() and
> btusb_send_frame_mtk() up to hci_send_frame(), which frees
> the skb a second time:
> 
> 	err = hdev->send(hdev, skb);
> 	if (err < 0) {
> 		bt_dev_err(hdev, "sending frame failed (%d)", err);
> 		kfree_skb(skb);
> 		return err;
> 	}
> 
> [...]

Here is the summary with links:
  - Bluetooth: btmtk: fix skb double free on ISO padding failure
    https://git.kernel.org/bluetooth/bluetooth-next/c/2820ae3262bd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html