diff options
| author | Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2024-02-28 11:17:24 -0500 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2024-03-26 18:19:38 -0400 |
| commit | 620b9e60e4b55fa55540ce852a0f3c9e6091dbbc (patch) | |
| tree | ccf044043d6d31e96fe6c6df2a464207aada1932 /drivers/bluetooth | |
| parent | 98e9920c75e0790bff947a00d192d24bf1c724e0 (diff) | |
| download | linux-rpi-620b9e60e4b55fa55540ce852a0f3c9e6091dbbc.tar.gz linux-rpi-620b9e60e4b55fa55540ce852a0f3c9e6091dbbc.tar.bz2 linux-rpi-620b9e60e4b55fa55540ce852a0f3c9e6091dbbc.zip | |
Bluetooth: btusb: Fix memory leak
[ Upstream commit 79f4127a502c5905f04da1f20a7bbe07103fb77c ]
This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone
the skb and also make sure btmtk_process_coredump frees the skb passed
following the same logic.
Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/bluetooth')
| -rw-r--r-- | drivers/bluetooth/btmtk.c | 4 | ||||
| -rw-r--r-- | drivers/bluetooth/btusb.c | 10 |
2 files changed, 9 insertions, 5 deletions
diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index aaabb732082c..285418dbb43f 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -372,8 +372,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb) struct btmediatek_data *data = hci_get_priv(hdev); int err; - if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) + if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) { + kfree_skb(skb); return 0; + } switch (data->cd_info.state) { case HCI_DEVCOREDUMP_IDLE: diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 66080fae072f..8dbdc51976e7 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3267,7 +3267,6 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb) { struct btusb_data *data = hci_get_drvdata(hdev); u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle); - struct sk_buff *skb_cd; switch (handle) { case 0xfc6f: /* Firmware dump from device */ @@ -3280,9 +3279,12 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb) * for backward compatibility, so we have to clone the packet * extraly for the in-kernel coredump support. */ - skb_cd = skb_clone(skb, GFP_ATOMIC); - if (skb_cd) - btmtk_process_coredump(hdev, skb_cd); + if (IS_ENABLED(CONFIG_DEV_COREDUMP)) { + struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC); + + if (skb_cd) + btmtk_process_coredump(hdev, skb_cd); + } fallthrough; case 0x05ff: /* Firmware debug logging 1 */ |