From: Zhengchao Shao Date: Mon, 9 Jan 2023 01:26:51 +0000 (+0800) Subject: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() X-Git-Tag: v6.1.9~214 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=8ac6043bd3e5b58d30f50737aedc2e58e8087ad5;p=platform%2Fkernel%2Flinux-starfive.git Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() [ Upstream commit 1ed8b37cbaf14574c779064ef1372af62e8ba6aa ] When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is not freed, which will cause memory leak, convert to use ERR_PTR/PTR_ERR to pass the instance to callback so no memory needs to be allocated. Fixes: 651cd3d65b0f ("Bluetooth: convert hci_update_adv_data to hci_sync") Signed-off-by: Zhengchao Shao Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Sasha Levin --- diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index 8d6c8cb..67dd4c9 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -6168,20 +6168,13 @@ int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, static int _update_adv_data_sync(struct hci_dev *hdev, void *data) { - u8 instance = *(u8 *)data; - - kfree(data); + u8 instance = PTR_ERR(data); return hci_update_adv_data_sync(hdev, instance); } int hci_update_adv_data(struct hci_dev *hdev, u8 instance) { - u8 *inst_ptr = kmalloc(1, GFP_KERNEL); - - if (!inst_ptr) - return -ENOMEM; - - *inst_ptr = instance; - return hci_cmd_sync_queue(hdev, _update_adv_data_sync, inst_ptr, NULL); + return hci_cmd_sync_queue(hdev, _update_adv_data_sync, + ERR_PTR(instance), NULL); }