From 491d2212ea0f0f6a3abbd67729df0c6a3ec9c58a Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Fri, 9 Oct 2026 10:35:25 +0200 Subject: [PATCH] Bluetooth: btmtk: fix skb double free on ISO padding failure btmtk_isopkt_pad() uses skb_pad(), which frees the skb on failure. The error is propagated by alloc_mtk_intr_urb() and btusb_send_frame_mtk() up to hci_send_frame(), which frees the skb a second time: err = hdev->send(hdev, skb); if (err < 0) { bt_dev_err(hdev, "sending frame failed (%d)", err); kfree_skb(skb); return err; } Use __skb_put_padto(skb, MTK_ISO_THRESHOLD, false) so that the skb is left to the caller on error. This also replaces the open-coded skb_pad() + __skb_put() sequence. Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions") Signed-off-by: Eric Dumazet Signed-off-by: Luiz Augusto von Dentz --- drivers/bluetooth/btmtk.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c index 115a11fcb254..bdc85147b97f 100644 --- a/drivers/bluetooth/btmtk.c +++ b/drivers/bluetooth/btmtk.c @@ -1101,12 +1101,8 @@ static int btmtk_isopkt_pad(struct hci_dev *hdev, struct sk_buff *skb) if (skb->len > MTK_ISO_THRESHOLD) return -EINVAL; - if (skb_pad(skb, MTK_ISO_THRESHOLD - skb->len)) - return -ENOMEM; - - __skb_put(skb, MTK_ISO_THRESHOLD - skb->len); - - return 0; + /* On error, the skb is freed by hci_send_frame(). */ + return __skb_put_padto(skb, MTK_ISO_THRESHOLD, false); } static int __set_mtk_intr_interface(struct hci_dev *hdev)