sieni
/
linux
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails 

When hci_cmd_sync_queue_once() returns with error, the destroy callback
will not be called.

Fix leaking references / memory on these failures.

Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Pauli Virtanen 2026-03-25 21:07:44 +02:00 committed by Luiz Augusto von Dentz
parent 2969554bcf
commit aca377208e
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/bluetooth/hci_sync.c
View File

@ -7460,13 +7460,16 @@ int hci_le_read_remote_features(struct hci_conn *conn)
* role is possible. Otherwise just transition into the * role is possible. Otherwise just transition into the
* connected state without requesting the remote features. * connected state without requesting the remote features.
*/ */
if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
err = hci_cmd_sync_queue_once(hdev, err = hci_cmd_sync_queue_once(hdev,
hci_le_read_remote_features_sync, hci_le_read_remote_features_sync,
hci_conn_hold(conn), hci_conn_hold(conn),
le_read_features_complete); le_read_features_complete);
else if (err)
hci_conn_drop(conn);
} else {
err = -EOPNOTSUPP; err = -EOPNOTSUPP;
}
return (err == -EEXIST) ? 0 : err; return (err == -EEXIST) ? 0 : err;
} }
@ -7505,6 +7508,9 @@ int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type)
err = hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp, err = hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp,
pkt_type_changed); pkt_type_changed);
if (err)
kfree(cp);
return (err == -EEXIST) ? 0 : err; return (err == -EEXIST) ? 0 : err;
} }
@ -7544,5 +7550,8 @@ int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys)
err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp, err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp,
le_phy_update_complete); le_phy_update_complete);
if (err)
kfree(cp);
return (err == -EEXIST) ? 0 : err; return (err == -EEXIST) ? 0 : err;
} }