diff options
| author | Zhengchao Shao | 2023-01-09 09:26:51 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2023-02-01 08:34:22 +0100 |
| commit | 8ac6043bd3e5b58d30f50737aedc2e58e8087ad5 (patch) | |
| tree | 2ceb9ef914773af6f6c0e8e087358315025cdba2 /net/bluetooth | |
| parent | f51a825b9f730a782aa768454906b4468e67b667 (diff) | |
Bluetooth: hci_sync: fix memory leak in hci_update_adv_data()
[ Upstream commit 1ed8b37cbaf14574c779064ef1372af62e8ba6aa ]
When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is
not freed, which will cause memory leak, convert to use ERR_PTR/PTR_ERR
to pass the instance to callback so no memory needs to be allocated.
Fixes: 651cd3d65b0f ("Bluetooth: convert hci_update_adv_data to hci_sync")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/bluetooth')
| -rw-r--r-- | net/bluetooth/hci_sync.c | 13 |
1 files changed, 3 insertions, 10 deletions
diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 8d6c8cbfe1de..67dd4c9fa4a5 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -6168,20 +6168,13 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, static int _update_adv_data_sync(struct hci_dev *hdev, void *data) { - u8 instance = *(u8 *)data; - - kfree(data); + u8 instance = PTR_ERR(data); return hci_update_adv_data_sync(hdev, instance); } int hci_update_adv_data(struct hci_dev *hdev, u8 instance) { - u8 *inst_ptr = kmalloc(1, GFP_KERNEL); - - if (!inst_ptr) - return -ENOMEM; - - *inst_ptr = instance; - return hci_cmd_sync_queue(hdev, _update_adv_data_sync, inst_ptr, NULL); + return hci_cmd_sync_queue(hdev, _update_adv_data_sync, + ERR_PTR(instance), NULL); } |