Commit 3aa21311 authored by Zhengchao Shao's avatar Zhengchao Shao Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: hci_conn: Fix memory leaks 



When hci_cmd_sync_queue() failed in hci_le_terminate_big() or
hci_le_big_terminate(), the memory pointed by variable d is not freed,
which will cause memory leak. Add release process to error path.

Fixes: eca0ae4a ("Bluetooth: Add initial implementation of BIS connections")
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 3a4d29b6

net/bluetooth/hci_conn.c

+14 −4
Original line number Diff line number Diff line
@@ -821,6 +821,7 @@ static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err) 
static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis)

{

	struct iso_list_data *d;

	int ret;



	bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", big, bis);
@@ -831,8 +832,12 @@ static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis) 
	d->big = big;

	d->bis = bis;



	return hci_cmd_sync_queue(hdev, terminate_big_sync, d,

	ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d,

				 terminate_big_destroy);

	if (ret)

		kfree(d);



	return ret;

}



static int big_terminate_sync(struct hci_dev *hdev, void *data)
@@ -857,6 +862,7 @@ static int big_terminate_sync(struct hci_dev *hdev, void *data) 
static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)

{

	struct iso_list_data *d;

	int ret;



	bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle);
@@ -867,8 +873,12 @@ static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle) 
	d->big = big;

	d->sync_handle = sync_handle;



	return hci_cmd_sync_queue(hdev, big_terminate_sync, d,

	ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,

				 terminate_big_destroy);

	if (ret)

		kfree(d);



	return ret;

}



/* Cleanup BIS connection