lkml.org 
[lkml]   [2023]   [Nov]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
Subject[PATCH v2 2/2] Bluetooth: btusb: Fix double free in handle_dump_pkt_qca()
From
The hci_devcd_init() returns 0 on success. Do not use this return value
when eturning from handle_dump_pkt_qca() as it incorrectly indicates
that it's not a dump packet.

This causes the first dump skb to be processed by both hci_devcd_rx()
and hci_recv_frame() leading to double free.

Fixes: 20981ce2d5a5 ("Bluetooth: btusb: Add WCN6855 devcoredump support")

Signed-off-by: Manish Mandlik <mmandlik@google.com>
---

(no changes since v1)

drivers/bluetooth/btusb.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 35a26440cabd..d23c992502c5 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3531,10 +3531,11 @@ static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
goto out;
}

- ret = hci_devcd_init(hdev, dump_size);
- if (ret < 0) {
- bt_dev_err(hdev, "memdump init error(%d)", ret);
- goto out;
+ if (hci_devcd_init(hdev, dump_size) < 0) {
+ bt_dev_err(hdev, "memdump init error");
+ clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
+ kfree_skb(skb);
+ return ret;
}

btdata->qca_dump.ram_dump_size = dump_size;
--
2.43.0.rc0.421.g78406f8d94-goog
\
 
 \ /
  Last update: 2023-11-20 14:03    [W:0.036 / U:0.084 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site