Commit 3aa21311 authored by Zhengchao Shao's avatar Zhengchao Shao Committed by Luiz Augusto von Dentz

Bluetooth: hci_conn: Fix memory leaks

When hci_cmd_sync_queue() failed in hci_le_terminate_big() or
hci_le_big_terminate(), the memory pointed by variable d is not freed,
which will cause memory leak. Add release process to error path.

Fixes: eca0ae4a ("Bluetooth: Add initial implementation of BIS connections")
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent 3a4d29b6
...@@ -821,6 +821,7 @@ static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err) ...@@ -821,6 +821,7 @@ static void terminate_big_destroy(struct hci_dev *hdev, void *data, int err)
static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis) static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis)
{ {
struct iso_list_data *d; struct iso_list_data *d;
int ret;
bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", big, bis); bt_dev_dbg(hdev, "big 0x%2.2x bis 0x%2.2x", big, bis);
...@@ -831,8 +832,12 @@ static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis) ...@@ -831,8 +832,12 @@ static int hci_le_terminate_big(struct hci_dev *hdev, u8 big, u8 bis)
d->big = big; d->big = big;
d->bis = bis; d->bis = bis;
return hci_cmd_sync_queue(hdev, terminate_big_sync, d, ret = hci_cmd_sync_queue(hdev, terminate_big_sync, d,
terminate_big_destroy); terminate_big_destroy);
if (ret)
kfree(d);
return ret;
} }
static int big_terminate_sync(struct hci_dev *hdev, void *data) static int big_terminate_sync(struct hci_dev *hdev, void *data)
...@@ -857,6 +862,7 @@ static int big_terminate_sync(struct hci_dev *hdev, void *data) ...@@ -857,6 +862,7 @@ static int big_terminate_sync(struct hci_dev *hdev, void *data)
static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle) static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)
{ {
struct iso_list_data *d; struct iso_list_data *d;
int ret;
bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle); bt_dev_dbg(hdev, "big 0x%2.2x sync_handle 0x%4.4x", big, sync_handle);
...@@ -867,8 +873,12 @@ static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle) ...@@ -867,8 +873,12 @@ static int hci_le_big_terminate(struct hci_dev *hdev, u8 big, u16 sync_handle)
d->big = big; d->big = big;
d->sync_handle = sync_handle; d->sync_handle = sync_handle;
return hci_cmd_sync_queue(hdev, big_terminate_sync, d, ret = hci_cmd_sync_queue(hdev, big_terminate_sync, d,
terminate_big_destroy); terminate_big_destroy);
if (ret)
kfree(d);
return ret;
} }
/* Cleanup BIS connection /* Cleanup BIS connection
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment