leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bluetooth: Fix memory leak in le_scan_disable_work_complete()

Browse Source 
The hci_request in le_scan_disable_work_complete() was being initialized
in a general context but only used in a specific branch in the function
(when simultaneous discovery is not supported). This patch moves the
usage to be limited to the branch where hci_req_run() is actually
called.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Johan Hedberg 2015-03-21 08:02:23 +02:00 committed by Marcel Holtmann
parent 15c32c5ff2
commit baf880a968
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
net/bluetooth/hci_core.c
View File

@ -2874,7 +2874,6 @@ static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
{ {
/* General inquiry access code (GIAC) */ /* General inquiry access code (GIAC) */
u8 lap[3] = { 0x33, 0x8b, 0x9e }; u8 lap[3] = { 0x33, 0x8b, 0x9e };
struct hci_request req;
struct hci_cp_inquiry cp; struct hci_cp_inquiry cp;
int err; int err;
@ -2893,13 +2892,6 @@ static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
break; break;
case DISCOV_TYPE_INTERLEAVED: case DISCOV_TYPE_INTERLEAVED:
hci_req_init(&req, hdev);
memset(&cp, 0, sizeof(cp));
memcpy(&cp.lap, lap, sizeof(cp.lap));
cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
hci_dev_lock(hdev); hci_dev_lock(hdev);
if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
@ -2914,8 +2906,17 @@ static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
hci_discovery_set_state(hdev, hci_discovery_set_state(hdev,
DISCOVERY_STOPPED); DISCOVERY_STOPPED);
} else { } else {
struct hci_request req;
hci_inquiry_cache_flush(hdev); hci_inquiry_cache_flush(hdev);
hci_req_init(&req, hdev);
memset(&cp, 0, sizeof(cp));
memcpy(&cp.lap, lap, sizeof(cp.lap));
cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
err = hci_req_run(&req, inquiry_complete); err = hci_req_run(&req, inquiry_complete);
if (err) { if (err) {
BT_ERR("Inquiry request failed: err %d", err); BT_ERR("Inquiry request failed: err %d", err);