Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Tue, 26 Jul 2022 18:13:44 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Marcel Holtmann <marcel@holtmann.org>,
        Manish Mandlik <mmandlik@google.com>
Cc:     Johan Hedberg <johan.hedberg@gmail.com>,
        Luiz Augusto von Dentz <luiz.dentz@gmail.com>,
        Miao-chen Chou <mcchou@google.com>,
        linux-bluetooth@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] Bluetooth: mgmt: Fix double free on error path
Message-ID: <YuAEqGGp/SRNP2Nr@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?OmSdUnuPipLfNyNG9c7i3r8Lr/eb6nPgHrv1w61nTS+XLjBbgmPT4ofwjeyc?=
 =?us-ascii?Q?wqnoEUGEGqMVGBkGic81FH4ziJIbGQFk//I7363xOX8eLLNJSSHSfzIWuj7X?=
 =?us-ascii?Q?AEUY92KFgf2ies+ncxyShJCqDX1gBPaHBBUvNUXwkgLyTbZy/WS5DWh/goFX?=
 =?us-ascii?Q?p4FK0Ls2QLiY8+QytgKEJwE/5Xi4AmOZqbl9/JMaYhXnzuAhrXeXUNaZArdG?=
 =?us-ascii?Q?x8YcndZKDjJ40qvgbJI2wGwfSvB8SdZRZKDpykPd4laoMYOFh/fImfPO8Gil?=
 =?us-ascii?Q?Kn0Tp5bfHRXFx14xQjmRqsKsCz8eCmkHb8+w0Ggt73BVrcND2nogyoJfNn08?=
 =?us-ascii?Q?GCGVPQ5zouXVNf3grqlX3JdjXG/euFRL+6qs5nsqxz4kdz7C2VucYz1vULKO?=
 =?us-ascii?Q?leg3ixj+f8Z9gcfOO9U1IDUjkEGExf60ToUe99rjuk24VlSuSmwJqoszVMSf?=
 =?us-ascii?Q?EOyjykGmiXtsdYqDQ43sH+kWta8cr1lEU7owv4H+V+Nzgb+Ne644UYnaaCUq?=
 =?us-ascii?Q?uLdrds98vPQYoWpce9EDk6KzyuZcCEU42zK7KmYLNLc3wq5p6dDOSqA9aNvH?=
 =?us-ascii?Q?Od3Wt/dQ/vTWupR3RZe/KVFDS0FsiNF3fZ8m/Du+ecLhe+KTHWQhO18Jv4/F?=
 =?us-ascii?Q?UpKttQ4gwoIipLyxBF9G1phL5jAZNWdDi4A/29gE/RiiWW5+ehtrVTDz+Con?=
 =?us-ascii?Q?cSuHflh7XtaS5djtyoNoxp7o4s9sQGYC+BVBl26BlZzdNQyybH97PyXCQy+a?=
 =?us-ascii?Q?JkpwBXQ5dbmv8Gmc0yLRI71MPFInPRRm+W1Dgw/gD/IhWKS4RTB6T/xcfpWD?=
 =?us-ascii?Q?qaR1l3Hq9F8iJPbYuzaqHaGgkqm0IxXEflUKrut0YJxfr0QKG0zWt2X4QeGw?=
 =?us-ascii?Q?pHRyzXEqIgrk8cs6OG9qPbKqw0+CO2vXPBTAJmlIfdPi9EB/aGWOlHHS1ZET?=
 =?us-ascii?Q?TeaOhNQ03Q7aJ/4PZnY56EqssDDsbWyS3FKnRtLQxcVH76KpAxE01yCJ3np+?=
 =?us-ascii?Q?bS21MKyzYa8xUytHfAvC3iFivg5z3b9ROtGfoEPWbN9KXsoSkXHb1xQ1WpoV?=
 =?us-ascii?Q?0yH9Tv4VWhZB9h3Ab4TotLhuax2F4U3Dv59Y6kQ9XsyeUWhOsqlx8n8Yo2s6?=
 =?us-ascii?Q?88lUnws2mq2pRweu6ZEKkgt2OEth40wwclNTMp0LKb469FxA51tPXGOtoi0I?=
 =?us-ascii?Q?amqtCxMdohcZHhkgdkse88EFoD1AOr2z01zRC7uS2BKELBgvRq3CFYIFwADb?=
 =?us-ascii?Q?nala7xOxyjgDVKW2gLqv1zx1XbDGFuMnldz1vybV1q98ec6P+/FPlP/3PIIE?=
 =?us-ascii?Q?SrkhEpxV1vHlOepcfTs6CVV2RWTOpOHsJkZ5jaKKFrHD4/VGzpHZJygL7MlW?=
 =?us-ascii?Q?RrhJQI+NsONnqA/gXW26qER7ILGa7uuV4wbBQnmGGUBfV2BhywBwqK8uBThr?=
 =?us-ascii?Q?himi6m+l6ZnIJpQY+lB2x7gBwu6GFLM9gprjf/3Jotqplm1HkaZ8MFEqoTaN?=
 =?us-ascii?Q?tamjQWPHuBKp2phOs27FRcH2Q/3wXOuieM+69BMFvruOVB9PAJs5XK3vkhA8?=
 =?us-ascii?Q?vWppDqM18XUIVpPhxtJC91oPocv3BN4O7tLrTrqWkb6/LWszbyHW0ksEWcNf?=
 =?us-ascii?Q?AQ=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3466f567-aa00-4809-e604-08da6f19746b
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Jul 2022 15:13:54.5846
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: aOifJB1drrmkPA+PvpyxXiGf+KnEWFw/SCP95pXr+tW68bpQBpvnaQWWiFnBvTB4UkocYlskON5ZtHOGalEKH43rhw2gSpK6loWuzMF1shw=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR10MB4228
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.883,Hydra:6.0.517,FMLib:17.11.122.1
 definitions=2022-07-26_04,2022-07-26_01,2022-06-22_01
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0 malwarescore=0
 adultscore=0 mlxscore=0 mlxlogscore=999 suspectscore=0 spamscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2206140000
 definitions=main-2207260059
X-Proofpoint-ORIG-GUID: G0d3vJJTeO_3Jd8Qukvuts2fAi6eSwrb
X-Proofpoint-GUID: G0d3vJJTeO_3Jd8Qukvuts2fAi6eSwrb
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Don't call mgmt_pending_remove() twice (double free).

Fixes: 6b88eff43704 ("Bluetooth: hci_sync: Refactor remove Adv Monitor")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 net/bluetooth/mgmt.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 0c6878095709..2bca36b9f3a2 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5056,7 +5056,6 @@ static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev,
 		else
 			status = MGMT_STATUS_FAILED;
 
-		mgmt_pending_remove(cmd);
 		goto unlock;
 	}
 
-- 
2.35.1