lkml.org 
[lkml]   [2021]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.11 076/775] Bluetooth: btusb: Fix memory leak in btusb_mtk_wmt_recv
    Date
    From: Jupeng Zhong <zhongjupeng@yulong.com>

    [ Upstream commit de71a6cb4bf24d8993b9ca90d1ddb131b60251a1 ]

    In btusb_mtk_wmt_recv if skb_clone fails, the alocated skb should be
    released.

    Omit the labels “err_out” and “err_free_skb” in this function
    implementation so that the desired exception handling code
    would be directly specified in the affected if branches.

    Fixes: a1c49c434e15 ("btusb: Add protocol support for MediaTek MT7668U USB devices")
    Signed-off-by: Jupeng Zhong <zhongjupeng@yulong.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/bluetooth/btusb.c | 20 ++++++++++----------
    1 file changed, 10 insertions(+), 10 deletions(-)

    diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    index da57c561642c4..a4f834a50a988 100644
    --- a/drivers/bluetooth/btusb.c
    +++ b/drivers/bluetooth/btusb.c
    @@ -3195,7 +3195,7 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
    skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
    if (!skb) {
    hdev->stat.err_rx++;
    - goto err_out;
    + return;
    }

    hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
    @@ -3213,13 +3213,18 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
    */
    if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
    data->evt_skb = skb_clone(skb, GFP_ATOMIC);
    - if (!data->evt_skb)
    - goto err_out;
    + if (!data->evt_skb) {
    + kfree_skb(skb);
    + return;
    + }
    }

    err = hci_recv_frame(hdev, skb);
    - if (err < 0)
    - goto err_free_skb;
    + if (err < 0) {
    + kfree_skb(data->evt_skb);
    + data->evt_skb = NULL;
    + return;
    + }

    if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
    &data->flags)) {
    @@ -3228,11 +3233,6 @@ static void btusb_mtk_wmt_recv(struct urb *urb)
    wake_up_bit(&data->flags,
    BTUSB_TX_WAIT_VND_EVT);
    }
    -err_out:
    - return;
    -err_free_skb:
    - kfree_skb(data->evt_skb);
    - data->evt_skb = NULL;
    return;
    } else if (urb->status == -ENOENT) {
    /* Avoid suspend failed when usb_kill_urb */
    --
    2.27.0


    \
     
     \ /
      Last update: 2021-03-02 01:11    [W:4.988 / U:0.112 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site