lkml.org 
[lkml]   [2022]   [Mar]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] Bluetooth: btmtkuart: fix free unallocated memory in mtk_hci_wmt_sync()
Date
If 'hlen > 255' is true, jump to 'err_free_skb' label and
free 'wc' that not allocated.
Fix by initializing 'wc' with NULL, as no operation is performed in
kfree().

if (hlen > 255) {
err = -EINVAL;
goto err_free_skb;
}
...
err_free_skb:
kfree_skb(bdev->evt_skb);
bdev->evt_skb = NULL;
err_free_wc:
kfree(wc);

Fixes: 3e5f2d90c28f ("Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync")
Signed-off-by: Yu Liao <liaoyu15@huawei.com>
---
drivers/bluetooth/btmtkuart.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index 695e1225b08c..4f3b2d3fa941 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -93,7 +93,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev,
struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
u32 hlen, status = BTMTK_WMT_INVALID;
struct btmtk_hci_wmt_evt *wmt_evt;
- struct btmtk_hci_wmt_cmd *wc;
+ struct btmtk_hci_wmt_cmd *wc = NULL;
struct btmtk_wmt_hdr *hdr;
int err;

--
2.25.1
\
 
 \ /
  Last update: 2022-03-17 08:40    [W:0.025 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site