Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
IronPort-SDR: /cG/oEZ3OFSdeZLOwaTPS7LqUBsJAbsqK76PsRtcVaJTXI898qj+KsSPAdMYusuw/qgwfOxrtw
 JalYQkZzzjcA==
IronPort-SDR: Z/Cz0HTudo5hAXgwvd7jJLQfswHxiD57Yx1LXgmu2c2CsN59ba2HVzINqs/21yY8rk3eJwyUOL
 q65TzO9Dugcw==
From:   Inga Stotland <inga.stotland@intel.com>
To:     linux-bluetooth@vger.kernel.org
Cc:     brian.gix@intel.com, Inga Stotland <inga.stotland@intel.com>
Subject: [PATCH BlueZ] mesh: Fix memory leak and NULL pointer dereference
Date:   Mon,  9 Nov 2020 20:21:27 -0800
Message-Id: <20201110042127.71045-1-inga.stotland@intel.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

This fixes a potential NULL pointer dereferencing in mesh_model_pub_set()
when virtual address publication cannot be successfully stored.
Also, fix a minor memory leak that may occur on unsuccessful model
initialization from storage.
---
 mesh/model.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/mesh/model.c b/mesh/model.c
index c8eb8c607..82078ed85 100644
--- a/mesh/model.c
+++ b/mesh/model.c
@@ -1091,11 +1091,11 @@ int mesh_model_pub_set(struct mesh_node *node, uint16_t addr, uint32_t id,
 		status = set_virt_pub(mod, pub_addr, idx, cred_flag, ttl,
 							period, cnt, interval);
 
-	*pub_dst = mod->pub->addr;
-
 	if (status != MESH_STATUS_SUCCESS)
 		return status;
 
+	*pub_dst = mod->pub->addr;
+
 	if (!mod->cbs)
 		/* External model */
 		config_update_model_pub_period(node, ele_idx, id,
@@ -1639,8 +1639,10 @@ static struct mesh_model *model_setup(struct mesh_net *net, uint8_t ele_idx,
 	/* Implicitly bind config server model to device key */
 	if (db_mod->id == CONFIG_SRV_MODEL) {
 
-		if (ele_idx != PRIMARY_ELE_IDX)
+		if (ele_idx != PRIMARY_ELE_IDX) {
+			l_free(mod);
 			return NULL;
+		}
 
 		l_queue_push_head(mod->bindings,
 					L_UINT_TO_PTR(APP_IDX_DEV_LOCAL));
-- 
2.26.2