Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-5086-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
To: linux-bluetooth@vger.kernel.org
Subject: [PATCH BlueZ v2 1/3] shared/csip: Fix memory leak
Date: Mon,  3 Jun 2024 14:53:10 -0400
Message-ID: <20240603185312.162337-1-luiz.dentz@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

This fixes the following leak:

102 bytes in 6 blocks are definitely lost in loss record 660 of 909
   at 0x484282F: malloc (vg_replace_malloc.c:446)
   by 0x5A078B: util_malloc (util.c:46)
   by 0x649162: read_sirk (csip.c:485)
   by 0x5C74FA: read_cb (gatt-client.c:2713)
   by 0x5C4137: handle_rsp (att.c:880)
   by 0x5C4137: can_read_data (att.c:1072)
   by 0x65DDA4: watch_callback (io-glib.c:157)
   by 0x49656AB: ??? (in /usr/lib64/libglib-2.0.so.0.8000.2)
   by 0x49C6707: ??? (in /usr/lib64/libglib-2.0.so.0.8000.2)
   by 0x496B666: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.8000.2)
   by 0x65FE3D: mainloop_run (mainloop-glib.c:66)
   by 0x6605A3: mainloop_run_with_signal (mainloop-notify.c:188)
   by 0x31DEFA: main (main.c:1468)
---
 src/shared/csip.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/shared/csip.c b/src/shared/csip.c
index e13efb6ce634..87b4590d926d 100644
--- a/src/shared/csip.c
+++ b/src/shared/csip.c
@@ -128,6 +128,15 @@ void bt_csip_detach(struct bt_csip *csip)
 	queue_foreach(csip_cbs, csip_detached, csip);
 }
 
+static void csis_free(struct bt_csis *csis)
+{
+	if (!csis)
+		return;
+
+	free(csis->sirk_val);
+	free(csis);
+}
+
 static void csip_db_free(void *data)
 {
 	struct bt_csip_db *cdb = data;
@@ -137,7 +146,7 @@ static void csip_db_free(void *data)
 
 	gatt_db_unref(cdb->db);
 
-	free(cdb->csis);
+	csis_free(cdb->csis);
 	free(cdb);
 }
 
-- 
2.45.1