2024-02-02 23:57:02

by Sean Wang

Subject: [PATCH] Bluetooth: btusb: medaitek: fix double free of skb in coredump

From: Sean Wang <[email protected]>

hci_devcd_append() would free the skb on error so the caller don't
have to free it again otherwise it would cause the double free of skb.

Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
Reported-by : Dan Carpenter <[email protected]>
Signed-off-by: Sean Wang <[email protected]>
---
drivers/bluetooth/btmtk.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index aaabb732082c..e882613036a0 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -378,8 +378,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
switch (data->cd_info.state) {
case HCI_DEVCOREDUMP_IDLE:
err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE);
- if (err < 0)
+ if (err < 0) {
+ kfree_skb(skb);
break;
+ }
data->cd_info.cnt = 0;

/* It is supposed coredump can be done within 5 seconds */
@@ -405,9 +407,6 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
break;
}

- if (err < 0)
- kfree_skb(skb);
-
return err;
}
EXPORT_SYMBOL_GPL(btmtk_process_coredump);
--
2.25.1

2024-02-05 08:37:28

by Kalle Valo

Subject: Re: [PATCH] Bluetooth: btusb: medaitek: fix double free of skb in coredump

<[email protected]> writes:

> From: Sean Wang <[email protected]>
>
> hci_devcd_append() would free the skb on error so the caller don't
> have to free it again otherwise it would cause the double free of skb.
>
> Fixes: 0b7015132878 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
> Reported-by : Dan Carpenter <[email protected]>
> Signed-off-by: Sean Wang <[email protected]>
> ---
> drivers/bluetooth/btmtk.c | 7 +++----
> 1 file changed, 3 insertions(+), 4 deletions(-)

This should be sent to the bluetooth list.

--
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches