* [PATCH] Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
@ 2021-09-22 13:49 ` Dinghao Liu
0 siblings, 0 replies; 7+ messages in thread
From: Dinghao Liu @ 2021-09-22 13:49 UTC (permalink / raw)
To: dinghao.liu
Cc: Sean Wang, Marcel Holtmann, Johan Hedberg,
Luiz Augusto von Dentz, Matthias Brugger, linux-bluetooth,
linux-mediatek, linux-arm-kernel, linux-kernel
bdev->evt_skb will get freed in the normal path and one error path
of mtk_hci_wmt_sync, while the other error paths do not free it,
which may cause a memleak. This bug is suggested by a static analysis
tool, please advise.
Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
---
drivers/bluetooth/btmtkuart.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index e9d91d7c0db4..9ba22b13b4fa 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -158,8 +158,10 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
int err;
hlen = sizeof(*hdr) + wmt_params->dlen;
- if (hlen > 255)
- return -EINVAL;
+ if (hlen > 255) {
+ err = -EINVAL;
+ goto err_free_skb;
+ }
hdr = (struct mtk_wmt_hdr *)&wc;
hdr->dir = 1;
@@ -173,7 +175,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc);
if (err < 0) {
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
- return err;
+ goto err_free_skb;
}
/* The vendor specific WMT commands are all answered by a vendor
@@ -190,13 +192,14 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
if (err == -EINTR) {
bt_dev_err(hdev, "Execution of wmt command interrupted");
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
- return err;
+ goto err_free_skb;
}
if (err) {
bt_dev_err(hdev, "Execution of wmt command timed out");
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
- return -ETIMEDOUT;
+ err = -ETIMEDOUT;
+ goto err_free_skb;
}
/* Parse and handle the return WMT event */
--
2.17.1
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH] Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
@ 2021-09-22 13:49 ` Dinghao Liu
0 siblings, 0 replies; 7+ messages in thread
From: Dinghao Liu @ 2021-09-22 13:49 UTC (permalink / raw)
To: dinghao.liu
Cc: Sean Wang, Marcel Holtmann, Johan Hedberg,
Luiz Augusto von Dentz, Matthias Brugger, linux-bluetooth,
linux-mediatek, linux-arm-kernel, linux-kernel
bdev->evt_skb will get freed in the normal path and one error path
of mtk_hci_wmt_sync, while the other error paths do not free it,
which may cause a memleak. This bug is suggested by a static analysis
tool, please advise.
Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
---
drivers/bluetooth/btmtkuart.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index e9d91d7c0db4..9ba22b13b4fa 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -158,8 +158,10 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
int err;
hlen = sizeof(*hdr) + wmt_params->dlen;
- if (hlen > 255)
- return -EINVAL;
+ if (hlen > 255) {
+ err = -EINVAL;
+ goto err_free_skb;
+ }
hdr = (struct mtk_wmt_hdr *)&wc;
hdr->dir = 1;
@@ -173,7 +175,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
err = __hci_cmd_send(hdev, 0xfc6f, hlen, &wc);
if (err < 0) {
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
- return err;
+ goto err_free_skb;
}
/* The vendor specific WMT commands are all answered by a vendor
@@ -190,13 +192,14 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
if (err == -EINTR) {
bt_dev_err(hdev, "Execution of wmt command interrupted");
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
- return err;
+ goto err_free_skb;
}
if (err) {
bt_dev_err(hdev, "Execution of wmt command timed out");
clear_bit(BTMTKUART_TX_WAIT_VND_EVT, &bdev->tx_state);
- return -ETIMEDOUT;
+ err = -ETIMEDOUT;
+ goto err_free_skb;
}
/* Parse and handle the return WMT event */
--
2.17.1
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH] Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
2021-09-22 13:49 ` Dinghao Liu
(?)
@ 2021-09-22 14:16 ` Marcel Holtmann
-1 siblings, 0 replies; 7+ messages in thread
From: Marcel Holtmann @ 2021-09-22 14:16 UTC (permalink / raw)
To: Dinghao Liu
Cc: Sean Wang, Johan Hedberg, Luiz Augusto von Dentz,
Matthias Brugger, linux-bluetooth, linux-mediatek,
linux-arm-kernel, linux-kernel
Hi Dinghao,
> bdev->evt_skb will get freed in the normal path and one error path
> of mtk_hci_wmt_sync, while the other error paths do not free it,
> which may cause a memleak. This bug is suggested by a static analysis
> tool, please advise.
>
> Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
> Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
> ---
> drivers/bluetooth/btmtkuart.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
patch has been applied to bluetooth-next tree.
Regards
Marcel
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
@ 2021-09-22 14:16 ` Marcel Holtmann
0 siblings, 0 replies; 7+ messages in thread
From: Marcel Holtmann @ 2021-09-22 14:16 UTC (permalink / raw)
To: Dinghao Liu
Cc: Sean Wang, Johan Hedberg, Luiz Augusto von Dentz,
Matthias Brugger, linux-bluetooth, linux-mediatek,
linux-arm-kernel, linux-kernel
Hi Dinghao,
> bdev->evt_skb will get freed in the normal path and one error path
> of mtk_hci_wmt_sync, while the other error paths do not free it,
> which may cause a memleak. This bug is suggested by a static analysis
> tool, please advise.
>
> Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
> Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
> ---
> drivers/bluetooth/btmtkuart.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
patch has been applied to bluetooth-next tree.
Regards
Marcel
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH] Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
@ 2021-09-22 14:16 ` Marcel Holtmann
0 siblings, 0 replies; 7+ messages in thread
From: Marcel Holtmann @ 2021-09-22 14:16 UTC (permalink / raw)
To: Dinghao Liu
Cc: Sean Wang, Johan Hedberg, Luiz Augusto von Dentz,
Matthias Brugger, linux-bluetooth, linux-mediatek,
linux-arm-kernel, linux-kernel
Hi Dinghao,
> bdev->evt_skb will get freed in the normal path and one error path
> of mtk_hci_wmt_sync, while the other error paths do not free it,
> which may cause a memleak. This bug is suggested by a static analysis
> tool, please advise.
>
> Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")
> Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
> ---
> drivers/bluetooth/btmtkuart.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
patch has been applied to bluetooth-next tree.
Regards
Marcel
_______________________________________________
Linux-mediatek mailing list
Linux-mediatek@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-mediatek
^ permalink raw reply [flat|nested] 7+ messages in thread
* RE: Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
2021-09-22 13:49 ` Dinghao Liu
` (2 preceding siblings ...)
(?)
@ 2021-09-22 15:02 ` bluez.test.bot
-1 siblings, 0 replies; 7+ messages in thread
From: bluez.test.bot @ 2021-09-22 15:02 UTC (permalink / raw)
To: linux-bluetooth, dinghao.liu
[-- Attachment #1: Type: text/plain, Size: 1292 bytes --]
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=551035
---Test result---
Test Summary:
CheckPatch PASS 0.87 seconds
GitLint FAIL 0.30 seconds
BuildKernel PASS 667.69 seconds
TestRunner: Setup PASS 434.04 seconds
TestRunner: l2cap-tester PASS 3.30 seconds
TestRunner: bnep-tester PASS 2.21 seconds
TestRunner: mgmt-tester PASS 35.74 seconds
TestRunner: rfcomm-tester PASS 2.57 seconds
TestRunner: smp-tester PASS 2.60 seconds
TestRunner: userchan-tester PASS 2.28 seconds
Details
##############################
Test: GitLint - FAIL - 0.30 seconds
Run gitlint with rule in .gitlint
Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync
2: B4 Second line is not empty: "of mtk_hci_wmt_sync, while the other error paths do not free it,"
6: B1 Line exceeds max length (101>80): "Fixes: e0b67035a90b ("Bluetooth: mediatek: update the common setup between MT7622 and other devices")"
---
Regards,
Linux Bluetooth
[-- Attachment #2: l2cap-tester.log --]
[-- Type: application/octet-stream, Size: 51566 bytes --]
[-- Attachment #3: bnep-tester.log --]
[-- Type: application/octet-stream, Size: 3934 bytes --]
[-- Attachment #4: mgmt-tester.log --]
[-- Type: application/octet-stream, Size: 626747 bytes --]
[-- Attachment #5: rfcomm-tester.log --]
[-- Type: application/octet-stream, Size: 14791 bytes --]
[-- Attachment #6: smp-tester.log --]
[-- Type: application/octet-stream, Size: 11857 bytes --]
[-- Attachment #7: userchan-tester.log --]
[-- Type: application/octet-stream, Size: 7768 bytes --]
^ permalink raw reply [flat|nested] 7+ messages in thread