[bluetooth-next:master 48/84] drivers/bluetooth/btmrvl_sdio.c:819 btmrvl_sdio_card_to_host() error: double free of 'skb' (line 802)
kernel test robot <[email protected]>
| Newsgroups | dev.linux.lists.oe-kbuild |
|---|---|
| Message-ID | <[email protected]> |
BCC: [email protected] CC: [email protected] CC: [email protected] TO: Zijun Hu <[email protected]> CC: Luiz Augusto von Dentz <[email protected]> tree: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master head: 43a556b2fd43f2df6dded59c2e26560a27874c24 commit: 760163572bb0ab79857c11aafb6eb33e697a22a0 [48/84] Bluetooth: btmrvl_sdio: Do not free HCI_VENDOR_PKT frame by hci_recv_frame() :::::: branch date: 2 days ago :::::: commit date: 2 days ago config: i386-randconfig-141-20260809 (https://download.01.org/0day-ci/archive/20260809/[email protected]/config) compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211) smatch: v0.5.0-9187-g5189e3fb If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <[email protected]> | Reported-by: Dan Carpenter <[email protected]> | Closes: https://lore.kernel.org/r/[email protected]/ smatch warnings: drivers/bluetooth/btmrvl_sdio.c:819 btmrvl_sdio_card_to_host() error: double free of 'skb' (line 802) vim +/skb +819 drivers/bluetooth/btmrvl_sdio.c 789221ecc87011 Bing Zhao 2009-06-02 701 789221ecc87011 Bing Zhao 2009-06-02 702 static int btmrvl_sdio_card_to_host(struct btmrvl_private *priv) 789221ecc87011 Bing Zhao 2009-06-02 703 { 789221ecc87011 Bing Zhao 2009-06-02 704 u16 buf_len = 0; 42632805f5f2d7 Andrei Emeltchenko 2012-09-28 705 int ret, num_blocks, blksz; 789221ecc87011 Bing Zhao 2009-06-02 706 struct sk_buff *skb = NULL; 789221ecc87011 Bing Zhao 2009-06-02 707 u32 type; 9376e4a5a318e1 Markus Elfring 2018-03-12 708 u8 *payload; 789221ecc87011 Bing Zhao 2009-06-02 709 struct hci_dev *hdev = priv->btmrvl_dev.hcidev; 789221ecc87011 Bing Zhao 2009-06-02 710 struct btmrvl_sdio_card *card = priv->btmrvl_dev.card; 789221ecc87011 Bing Zhao 2009-06-02 711 789221ecc87011 Bing Zhao 2009-06-02 712 if (!card || !card->func) { 789221ecc87011 Bing Zhao 2009-06-02 713 BT_ERR("card or function is NULL!"); 789221ecc87011 Bing Zhao 2009-06-02 714 ret = -EINVAL; 789221ecc87011 Bing Zhao 2009-06-02 715 goto exit; 789221ecc87011 Bing Zhao 2009-06-02 716 } 789221ecc87011 Bing Zhao 2009-06-02 717 789221ecc87011 Bing Zhao 2009-06-02 718 /* Read the length of data to be transferred */ 789221ecc87011 Bing Zhao 2009-06-02 719 ret = btmrvl_sdio_read_rx_len(card, &buf_len); 789221ecc87011 Bing Zhao 2009-06-02 720 if (ret < 0) { 789221ecc87011 Bing Zhao 2009-06-02 721 BT_ERR("read rx_len failed"); 789221ecc87011 Bing Zhao 2009-06-02 722 ret = -EIO; 789221ecc87011 Bing Zhao 2009-06-02 723 goto exit; 789221ecc87011 Bing Zhao 2009-06-02 724 } 789221ecc87011 Bing Zhao 2009-06-02 725 789221ecc87011 Bing Zhao 2009-06-02 726 blksz = SDIO_BLOCK_SIZE; e678bad515f06d Andrei Emeltchenko 2012-09-28 727 num_blocks = DIV_ROUND_UP(buf_len, blksz); 789221ecc87011 Bing Zhao 2009-06-02 728 789221ecc87011 Bing Zhao 2009-06-02 729 if (buf_len <= SDIO_HEADER_LEN 42632805f5f2d7 Andrei Emeltchenko 2012-09-28 730 || (num_blocks * blksz) > ALLOC_BUF_SIZE) { 789221ecc87011 Bing Zhao 2009-06-02 731 BT_ERR("invalid packet length: %d", buf_len); 789221ecc87011 Bing Zhao 2009-06-02 732 ret = -EINVAL; 789221ecc87011 Bing Zhao 2009-06-02 733 goto exit; 789221ecc87011 Bing Zhao 2009-06-02 734 } 789221ecc87011 Bing Zhao 2009-06-02 735 789221ecc87011 Bing Zhao 2009-06-02 736 /* Allocate buffer */ 436018eee5eaf1 Jia-Ju Bai 2018-07-23 737 skb = bt_skb_alloc(num_blocks * blksz + BTSDIO_DMA_ALIGN, GFP_KERNEL); 1f438c6138ac57 Prasanna Karthik 2015-09-25 738 if (!skb) { 789221ecc87011 Bing Zhao 2009-06-02 739 BT_ERR("No free skb"); 6ea81c415574ac Wei Yongjun 2013-06-05 740 ret = -ENOMEM; 789221ecc87011 Bing Zhao 2009-06-02 741 goto exit; 789221ecc87011 Bing Zhao 2009-06-02 742 } 789221ecc87011 Bing Zhao 2009-06-02 743 3318b2362bf052 Bing Zhao 2009-07-08 744 if ((unsigned long) skb->data & (BTSDIO_DMA_ALIGN - 1)) { 3318b2362bf052 Bing Zhao 2009-07-08 745 skb_put(skb, (unsigned long) skb->data & 3318b2362bf052 Bing Zhao 2009-07-08 746 (BTSDIO_DMA_ALIGN - 1)); 3318b2362bf052 Bing Zhao 2009-07-08 747 skb_pull(skb, (unsigned long) skb->data & 3318b2362bf052 Bing Zhao 2009-07-08 748 (BTSDIO_DMA_ALIGN - 1)); 789221ecc87011 Bing Zhao 2009-06-02 749 } 789221ecc87011 Bing Zhao 2009-06-02 750 3318b2362bf052 Bing Zhao 2009-07-08 751 payload = skb->data; 789221ecc87011 Bing Zhao 2009-06-02 752 789221ecc87011 Bing Zhao 2009-06-02 753 ret = sdio_readsb(card->func, payload, card->ioport, 42632805f5f2d7 Andrei Emeltchenko 2012-09-28 754 num_blocks * blksz); 789221ecc87011 Bing Zhao 2009-06-02 755 if (ret < 0) { 789221ecc87011 Bing Zhao 2009-06-02 756 BT_ERR("readsb failed: %d", ret); 789221ecc87011 Bing Zhao 2009-06-02 757 ret = -EIO; 789221ecc87011 Bing Zhao 2009-06-02 758 goto exit; 789221ecc87011 Bing Zhao 2009-06-02 759 } 789221ecc87011 Bing Zhao 2009-06-02 760 789221ecc87011 Bing Zhao 2009-06-02 761 /* This is SDIO specific header length: byte[2][1][0], type: byte[3] 789221ecc87011 Bing Zhao 2009-06-02 762 * (HCI_COMMAND = 1, ACL_DATA = 2, SCO_DATA = 3, 0xFE = Vendor) 789221ecc87011 Bing Zhao 2009-06-02 763 */ 789221ecc87011 Bing Zhao 2009-06-02 764 789221ecc87011 Bing Zhao 2009-06-02 765 buf_len = payload[0]; 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 766 buf_len |= payload[1] << 8; 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 767 buf_len |= payload[2] << 16; 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 768 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 769 if (buf_len > blksz * num_blocks) { 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 770 BT_ERR("Skip incorrect packet: hdrlen %d buffer %d", 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 771 buf_len, blksz * num_blocks); 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 772 ret = -EIO; 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 773 goto exit; 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 774 } 9cb23dd4b63615 Andrei Emeltchenko 2012-09-28 775 789221ecc87011 Bing Zhao 2009-06-02 776 type = payload[3]; 789221ecc87011 Bing Zhao 2009-06-02 777 789221ecc87011 Bing Zhao 2009-06-02 778 switch (type) { 789221ecc87011 Bing Zhao 2009-06-02 779 case HCI_ACLDATA_PKT: 789221ecc87011 Bing Zhao 2009-06-02 780 case HCI_SCODATA_PKT: 789221ecc87011 Bing Zhao 2009-06-02 781 case HCI_EVENT_PKT: 618e8bc228cda7 Marcel Holtmann 2015-11-05 782 hci_skb_pkt_type(skb) = type; 789221ecc87011 Bing Zhao 2009-06-02 783 skb_put(skb, buf_len); 789221ecc87011 Bing Zhao 2009-06-02 784 skb_pull(skb, SDIO_HEADER_LEN); 789221ecc87011 Bing Zhao 2009-06-02 785 ea1e76a3f92f85 Andrei Emeltchenko 2012-06-13 786 if (type == HCI_EVENT_PKT) { ea1e76a3f92f85 Andrei Emeltchenko 2012-06-13 787 if (btmrvl_check_evtpkt(priv, skb)) e1a26170692dc1 Marcel Holtmann 2013-10-10 788 hci_recv_frame(hdev, skb); 2c2453f3e46139 Andrei Emeltchenko 2012-07-09 789 } else { e1a26170692dc1 Marcel Holtmann 2013-10-10 790 hci_recv_frame(hdev, skb); 2c2453f3e46139 Andrei Emeltchenko 2012-07-09 791 } ea1e76a3f92f85 Andrei Emeltchenko 2012-06-13 792 789221ecc87011 Bing Zhao 2009-06-02 793 hdev->stat.byte_rx += buf_len; 789221ecc87011 Bing Zhao 2009-06-02 794 break; 789221ecc87011 Bing Zhao 2009-06-02 795 789221ecc87011 Bing Zhao 2009-06-02 796 case MRVL_VENDOR_PKT: 618e8bc228cda7 Marcel Holtmann 2015-11-05 797 hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; 789221ecc87011 Bing Zhao 2009-06-02 798 skb_put(skb, buf_len); 789221ecc87011 Bing Zhao 2009-06-02 799 skb_pull(skb, SDIO_HEADER_LEN); 789221ecc87011 Bing Zhao 2009-06-02 800 789221ecc87011 Bing Zhao 2009-06-02 801 if (btmrvl_process_event(priv, skb)) 760163572bb0ab Zijun Hu 2026-07-25 @802 kfree_skb(skb); 789221ecc87011 Bing Zhao 2009-06-02 803 789221ecc87011 Bing Zhao 2009-06-02 804 hdev->stat.byte_rx += buf_len; 789221ecc87011 Bing Zhao 2009-06-02 805 break; 789221ecc87011 Bing Zhao 2009-06-02 806 789221ecc87011 Bing Zhao 2009-06-02 807 default: af901ca181d92a André Goddard Rosa 2009-11-14 808 BT_ERR("Unknown packet type:%d", type); 78c1b8e822a0bc Andrei Emeltchenko 2012-10-10 809 BT_ERR("hex: %*ph", blksz * num_blocks, payload); 789221ecc87011 Bing Zhao 2009-06-02 810 789221ecc87011 Bing Zhao 2009-06-02 811 kfree_skb(skb); 789221ecc87011 Bing Zhao 2009-06-02 812 skb = NULL; 789221ecc87011 Bing Zhao 2009-06-02 813 break; 789221ecc87011 Bing Zhao 2009-06-02 814 } 789221ecc87011 Bing Zhao 2009-06-02 815 789221ecc87011 Bing Zhao 2009-06-02 816 exit: 789221ecc87011 Bing Zhao 2009-06-02 817 if (ret) { 789221ecc87011 Bing Zhao 2009-06-02 818 hdev->stat.err_rx++; 789221ecc87011 Bing Zhao 2009-06-02 @819 kfree_skb(skb); 789221ecc87011 Bing Zhao 2009-06-02 820 } 789221ecc87011 Bing Zhao 2009-06-02 821 789221ecc87011 Bing Zhao 2009-06-02 822 return ret; 789221ecc87011 Bing Zhao 2009-06-02 823 } 789221ecc87011 Bing Zhao 2009-06-02 824 :::::: The code at line 819 was first introduced by commit :::::: 789221ecc870117b77e354d488d5d29f15410de8 Bluetooth: Add Marvell BT-over-SDIO driver :::::: TO: Bing Zhao <[email protected]> :::::: CC: Marcel Holtmann <[email protected]> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki