* [PATCH] Bluetooth: btmtkuart: fix free unallocated memory in mtk_hci_wmt_sync()
@ 2022-03-17 7:48 Yu Liao
0 siblings, 0 replies; only message in thread
From: Yu Liao @ 2022-03-17 7:48 UTC (permalink / raw)
To: linux-kernel; +Cc: marcel, liaoyu15, liwei391
If 'hlen > 255' is true, jump to 'err_free_skb' label and
free 'wc' that not allocated.
Fix by initializing 'wc' with NULL, as no operation is performed in
kfree().
if (hlen > 255) {
err = -EINVAL;
goto err_free_skb;
}
...
err_free_skb:
kfree_skb(bdev->evt_skb);
bdev->evt_skb = NULL;
err_free_wc:
kfree(wc);
Fixes: 3e5f2d90c28f ("Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync")
Signed-off-by: Yu Liao <liaoyu15@huawei.com>
---
drivers/bluetooth/btmtkuart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index 695e1225b08c..4f3b2d3fa941 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -93,7 +93,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
u32 hlen, status = BTMTK_WMT_INVALID;
struct btmtk_hci_wmt_evt *wmt_evt;
- struct btmtk_hci_wmt_cmd *wc;
+ struct btmtk_hci_wmt_cmd *wc = NULL;
struct btmtk_wmt_hdr *hdr;
int err;
--
2.25.1
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2022-03-17 7:39 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-17 7:48 [PATCH] Bluetooth: btmtkuart: fix free unallocated memory in mtk_hci_wmt_sync() Yu Liao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.