Bluetooth: btusb: mediatek: Fix double free of skb in coredump
hci_devcd_append() would free the skb on error so the caller don't
have to free it again otherwise it would cause the double free of skb.
Fixes: 0b70151328
("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
Reported-by : Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sean Wang <sean.wang@mediatek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
parent
6eb5fcc416
commit
18bdb386a1
|
@ -380,8 +380,10 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
|
||||||
switch (data->cd_info.state) {
|
switch (data->cd_info.state) {
|
||||||
case HCI_DEVCOREDUMP_IDLE:
|
case HCI_DEVCOREDUMP_IDLE:
|
||||||
err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE);
|
err = hci_devcd_init(hdev, MTK_COREDUMP_SIZE);
|
||||||
if (err < 0)
|
if (err < 0) {
|
||||||
|
kfree_skb(skb);
|
||||||
break;
|
break;
|
||||||
|
}
|
||||||
data->cd_info.cnt = 0;
|
data->cd_info.cnt = 0;
|
||||||
|
|
||||||
/* It is supposed coredump can be done within 5 seconds */
|
/* It is supposed coredump can be done within 5 seconds */
|
||||||
|
@ -407,9 +409,6 @@ int btmtk_process_coredump(struct hci_dev *hdev, struct sk_buff *skb)
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (err < 0)
|
|
||||||
kfree_skb(skb);
|
|
||||||
|
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL_GPL(btmtk_process_coredump);
|
EXPORT_SYMBOL_GPL(btmtk_process_coredump);
|
||||||
|
|
Loading…
Reference in New Issue