github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Bluetooth: btmtk: fix skb double free on ISO padding failure

Browse Source 
btmtk_isopkt_pad() uses skb_pad(), which frees the skb on failure.

The error is propagated by alloc_mtk_intr_urb() and
btusb_send_frame_mtk() up to hci_send_frame(), which frees
the skb a second time:

	err = hdev->send(hdev, skb);
	if (err < 0) {
		bt_dev_err(hdev, "sending frame failed (%d)", err);
		kfree_skb(skb);
		return err;
	}

Use __skb_put_padto(skb, MTK_ISO_THRESHOLD, false) so that the skb
is left to the caller on error. This also replaces the open-coded
skb_pad() + __skb_put() sequence.

Fixes: ceac1cb025 ("Bluetooth: btusb: mediatek: add ISO data transmission functions")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Eric Dumazet 2026-10-09 10:35:25 +02:00 committed by Luiz Augusto von Dentz
parent 8368f0c2cd
commit 491d2212ea
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/bluetooth/btmtk.c
View File

@ -1101,12 +1101,8 @@ static int btmtk_isopkt_pad(struct hci_dev *hdev, struct sk_buff *skb)
if (skb->len > MTK_ISO_THRESHOLD)
return -EINVAL;
if (skb_pad(skb, MTK_ISO_THRESHOLD - skb->len))
return -ENOMEM;
__skb_put(skb, MTK_ISO_THRESHOLD - skb->len);
return 0;
/* On error, the skb is freed by hci_send_frame(). */
return __skb_put_padto(skb, MTK_ISO_THRESHOLD, false);
}
static int __set_mtk_intr_interface(struct hci_dev *hdev)