[PATCH 10/11] Bluetooth: btmrvl_sdio: Do not free HCI_VENDOR_PKT frame by hci_recv_frame()
Zijun Hu <[email protected]> Sat, 25 Jul 2026 01:54:48 -0700
| Newsgroups | org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
For a HCI_VENDOR_PKT frame, hci_recv_frame() does not accept it and will kfree_skb() it directly. But btmrvl_sdio_card_to_host() is still calling hci_recv_frame() for the frame. Fix by freeing it with kfree_skb() directly. Signed-off-by: Zijun Hu <[email protected]> --- Previous version: https://lore.kernel.org/all/[email protected] Changes since previous version: - Improve commit title and message. --- drivers/bluetooth/btmrvl_sdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c index 93932a0d8625..b91fc63bc9fe 100644 --- a/drivers/bluetooth/btmrvl_sdio.c +++ b/drivers/bluetooth/btmrvl_sdio.c @@ -794,17 +794,17 @@ static int btmrvl_sdio_card_to_host(struct btmrvl_private *priv) break; case MRVL_VENDOR_PKT: hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; skb_put(skb, buf_len); skb_pull(skb, SDIO_HEADER_LEN); if (btmrvl_process_event(priv, skb)) - hci_recv_frame(hdev, skb); + kfree_skb(skb); hdev->stat.byte_rx += buf_len; break; default: BT_ERR("Unknown packet type:%d", type); BT_ERR("hex: %*ph", blksz * num_blocks, payload); -- 2.34.1