* [PATCH] Bluetooth: btusb: medaitek: fix double free of skb in coredump
@ 2024-02-02 23:55 sean.wang
2024-02-05 8:37 ` Kalle Valo
0 siblings, 1 reply; 2+ messages in thread
From: sean.wang @ 2024-02-02 23:55 UTC (permalink / raw)
To: nbd, lorenzo.bianconi
Cc: sean.wang, Soul.Huang, Leon.Yen, Eric-SY.Chang, Deren.Wu, km.lin,
robin.chiu, Eddie.Chen, jsiuda, frankgor, kuabhs, druth,
abhishekpandit, shawnku, linux-wireless, linux-mediatek
From: Sean Wang <sean.wang@mediatek.com>
hci_devcd_append() would free the skb on error so the caller don't
have to free it again otherwise it would cause the double free of skb.
Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
Reported-by : Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
---
drivers/bluetooth/btmtk.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index aaabb732082c..e882613036a0 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -378,8 +378,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
switch (data->cd_info.state) {
case HCI_DEVCOREDUMP_IDLE:
err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE);
- if (err < 0)
+ if (err < 0) {
+ kfree_skb(skb);
break;
+ }
data->cd_info.cnt = 0;
/* It is supposed coredump can be done within 5 seconds */
@@ -405,9 +407,6 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
break;
}
- if (err < 0)
- kfree_skb(skb);
-
return err;
}
EXPORT_SYMBOL_GPL(btmtk_process_coredump);
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Bluetooth: btusb: medaitek: fix double free of skb in coredump
2024-02-02 23:55 [PATCH] Bluetooth: btusb: medaitek: fix double free of skb in coredump sean.wang
@ 2024-02-05 8:37 ` Kalle Valo
0 siblings, 0 replies; 2+ messages in thread
From: Kalle Valo @ 2024-02-05 8:37 UTC (permalink / raw)
To: sean.wang
Cc: nbd, lorenzo.bianconi, Soul.Huang, Leon.Yen, Eric-SY.Chang,
Deren.Wu, km.lin, robin.chiu, Eddie.Chen, jsiuda, frankgor,
kuabhs, druth, abhishekpandit, shawnku, linux-wireless,
linux-mediatek
<sean.wang@mediatek.com> writes:
> From: Sean Wang <sean.wang@mediatek.com>
>
> hci_devcd_append() would free the skb on error so the caller don't
> have to free it again otherwise it would cause the double free of skb.
>
> Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
> Reported-by : Dan Carpenter <dan.carpenter@linaro.org>
> Signed-off-by: Sean Wang <sean.wang@mediatek.com>
> ---
> drivers/bluetooth/btmtk.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)
This should be sent to the bluetooth list.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-02-05 8:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-02-02 23:55 [PATCH] Bluetooth: btusb: medaitek: fix double free of skb in coredump sean.wang
2024-02-05 8:37 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).