Skip to content

Commit 79f4127

Browse files
committed
Bluetooth: btusb: Fix memory leak
This checks if CONFIG_DEV_COREDUMP is enabled before attempting to clone the skb and also make sure btmtk_process_coredump frees the skb passed following the same logic. Fixes: 0b70151 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support") Signed-off-by: Luiz Augusto von Dentz <[email protected]>
1 parent a6e0625 commit 79f4127

File tree

2 files changed

+9
-5
lines changed

2 files changed

+9
-5
lines changed

drivers/bluetooth/btmtk.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -372,8 +372,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
372372
struct btmediatek_data *data = hci_get_priv(hdev);
373373
int err;
374374

375-
if (!IS_ENABLED(CONFIG_DEV_COREDUMP))
375+
if (!IS_ENABLED(CONFIG_DEV_COREDUMP)) {
376+
kfree_skb(skb);
376377
return 0;
378+
}
377379

378380
switch (data->cd_info.state) {
379381
case HCI_DEVCOREDUMP_IDLE:

drivers/bluetooth/btusb.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3281,7 +3281,6 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
32813281
{
32823282
struct btusb_data *data = hci_get_drvdata(hdev);
32833283
u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
3284-
struct sk_buff *skb_cd;
32853284

32863285
switch (handle) {
32873286
case 0xfc6f: /* Firmware dump from device */
@@ -3294,9 +3293,12 @@ static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
32943293
* for backward compatibility, so we have to clone the packet
32953294
* extraly for the in-kernel coredump support.
32963295
*/
3297-
skb_cd = skb_clone(skb, GFP_ATOMIC);
3298-
if (skb_cd)
3299-
btmtk_process_coredump(hdev, skb_cd);
3296+
if (IS_ENABLED(CONFIG_DEV_COREDUMP)) {
3297+
struct sk_buff *skb_cd = skb_clone(skb, GFP_ATOMIC);
3298+
3299+
if (skb_cd)
3300+
btmtk_process_coredump(hdev, skb_cd);
3301+
}
33003302

33013303
fallthrough;
33023304
case 0x05ff: /* Firmware debug logging 1 */

0 commit comments

Comments
 (0)