Commit 36010ff6 authored by Marcel Holtmann's avatar Marcel Holtmann

[Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers

The transfer buffer of an URB will be automatically freed when using
the URB_FREE_BUFFER transfer_flag. So the extra calls to kfree() will
cause a double free.
Reported-by: default avatarJustin Mattock <justinmattock@gmail.com>
Signed-off-by: default avatarRabin Vincent <rabin@rab.in>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 94aca1da
...@@ -256,7 +256,6 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev) ...@@ -256,7 +256,6 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
BT_ERR("%s urb %p submission failed (%d)", BT_ERR("%s urb %p submission failed (%d)",
hdev->name, urb, -err); hdev->name, urb, -err);
usb_unanchor_urb(urb); usb_unanchor_urb(urb);
kfree(buf);
} }
usb_free_urb(urb); usb_free_urb(urb);
...@@ -298,7 +297,6 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev) ...@@ -298,7 +297,6 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
BT_ERR("%s urb %p submission failed (%d)", BT_ERR("%s urb %p submission failed (%d)",
hdev->name, urb, -err); hdev->name, urb, -err);
usb_unanchor_urb(urb); usb_unanchor_urb(urb);
kfree(buf);
} }
usb_free_urb(urb); usb_free_urb(urb);
......
...@@ -271,7 +271,6 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev) ...@@ -271,7 +271,6 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev)
BT_ERR("%s urb %p submission failed (%d)", BT_ERR("%s urb %p submission failed (%d)",
hdev->name, urb, -err); hdev->name, urb, -err);
usb_unanchor_urb(urb); usb_unanchor_urb(urb);
kfree(buf);
} }
usb_free_urb(urb); usb_free_urb(urb);
...@@ -354,7 +353,6 @@ static int btusb_submit_bulk_urb(struct hci_dev *hdev) ...@@ -354,7 +353,6 @@ static int btusb_submit_bulk_urb(struct hci_dev *hdev)
BT_ERR("%s urb %p submission failed (%d)", BT_ERR("%s urb %p submission failed (%d)",
hdev->name, urb, -err); hdev->name, urb, -err);
usb_unanchor_urb(urb); usb_unanchor_urb(urb);
kfree(buf);
} }
usb_free_urb(urb); usb_free_urb(urb);
...@@ -475,7 +473,6 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev) ...@@ -475,7 +473,6 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev)
BT_ERR("%s urb %p submission failed (%d)", BT_ERR("%s urb %p submission failed (%d)",
hdev->name, urb, -err); hdev->name, urb, -err);
usb_unanchor_urb(urb); usb_unanchor_urb(urb);
kfree(buf);
} }
usb_free_urb(urb); usb_free_urb(urb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment