Messages in this thread Patch in this message | | | From | Yu Liao <> | Subject | [PATCH] Bluetooth: btmtkuart: fix free unallocated memory in mtk_hci_wmt_sync() | Date | Thu, 17 Mar 2022 15:48:57 +0800 |
| |
If 'hlen > 255' is true, jump to 'err_free_skb' label and free 'wc' that not allocated. Fix by initializing 'wc' with NULL, as no operation is performed in kfree().
if (hlen > 255) { err = -EINVAL; goto err_free_skb; } ... err_free_skb: kfree_skb(bdev->evt_skb); bdev->evt_skb = NULL; err_free_wc: kfree(wc);
Fixes: 3e5f2d90c28f ("Bluetooth: btmtkuart: fix a memleak in mtk_hci_wmt_sync") Signed-off-by: Yu Liao <liaoyu15@huawei.com> --- drivers/bluetooth/btmtkuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c index 695e1225b08c..4f3b2d3fa941 100644 --- a/drivers/bluetooth/btmtkuart.c +++ b/drivers/bluetooth/btmtkuart.c @@ -93,7 +93,7 @@ static int mtk_hci_wmt_sync(struct hci_dev *hdev, struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc; u32 hlen, status = BTMTK_WMT_INVALID; struct btmtk_hci_wmt_evt *wmt_evt; - struct btmtk_hci_wmt_cmd *wc; + struct btmtk_hci_wmt_cmd *wc = NULL; struct btmtk_wmt_hdr *hdr; int err; -- 2.25.1
| |