bluetooth: fix memory leak in btusb_mtk_wmt_recv

Commit Message

[e-mail] Jan. 29, 2021, 2:08 a.m. UTC

From: zhongjupeng <[e-mail]>

In btusb_mtk_wmt_recv if skb_clone fails, the alocated skb should be
released.

Signed-off-by: zhongjupeng <[e-mail]>
---
 drivers/bluetooth/btusb.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

[e-mail] Jan. 29, 2021, 3:27 a.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=424183

---Test result---

##############################
    Test: CheckPatch - PASS
    

    ##############################
    Test: CheckGitLint - PASS
    

    ##############################
    Test: CheckBuildK - PASS
    

    ##############################
    Test: CheckTestRunner: Setup - PASS
    

    ##############################
    Test: CheckTestRunner: l2cap-tester - PASS
    Total: 40, Passed: 34 (85.0%), Failed: 0, Not Run: 6

    ##############################
    Test: CheckTestRunner: bnep-tester - PASS
    Total: 1, Passed: 1 (100.0%), Failed: 0, Not Run: 0

    ##############################
    Test: CheckTestRunner: mgmt-tester - PASS
    Total: 416, Passed: 402 (96.6%), Failed: 0, Not Run: 14

    ##############################
    Test: CheckTestRunner: rfcomm-tester - PASS
    Total: 9, Passed: 9 (100.0%), Failed: 0, Not Run: 0

    ##############################
    Test: CheckTestRunner: sco-tester - PASS
    Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0

    ##############################
    Test: CheckTestRunner: smp-tester - PASS
    Total: 8, Passed: 8 (100.0%), Failed: 0, Not Run: 0

    ##############################
    Test: CheckTestRunner: userchan-tester - PASS
    Total: 3, Passed: 3 (100.0%), Failed: 0, Not Run: 0

    

---
Regards,
Linux Bluetooth

Marcel Holtmann Feb. 1, 2021, 10:45 a.m. UTC | #2

Hi Jupeng,

>>>> In btusb_mtk_wmt_recv if skb_clone fails, the alocated skb should
>>>> be released.
>>>> 
>>>> Signed-off-by: zhongjupeng <[e-mail]>    
>>> 
>>> please provide a proper From: and Signed-off-by line with full name.
>>> 
>>> Regards
>>> 
>>> Marcel  
>> 
>>  Hi,
>> 
>> 
>>    Update the patch From: and Signed-off-by: as follows:
>> 
>> 	Jupeng Zhong <[e-mail]>
> 
> 
>  Hi,
> 
>    Thanks to Markus Elfring for the suggestion:
> 
>    1. add the tag “Fixes”.
>    2. omit the labels “err_out” and “err_free_skb” in this function
>       implementation.
> 
>    The patch has been updated, please check.
> 
>    Thanks.
> <0001-Bluetooth-btusb-Fix-memory-leak-in-btusb_mtk_wmt_rec.patch>

please send patch inline via git-send-email or similar so that they are easy to review.

Regards

Marcel

Patch

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index ffec6bc..cf21bba 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -3217,8 +3217,10 @@  static void btusb_mtk_wmt_recv(struct urb *urb)
 		 */
 		if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
 			data->evt_skb = skb_clone(skb, GFP_ATOMIC);
-			if (!data->evt_skb)
+			if (!data->evt_skb) {
+				kfree_skb(skb);
 				goto err_out;
+			}
 		}
 
 		err = hci_recv_frame(hdev, skb);