From: Mat Martineau Date: Thu, 17 May 2012 23:20:14 +0000 (-0700) Subject: Bluetooth: Free allocated ERTM SREJ list if init fails X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=9dc9affcb776b75f6d3e5d69d6e2a679407854f1;p=GitHub%2FLineageOS%2FG12%2Fandroid_kernel_amlogic_linux-4.9.git Bluetooth: Free allocated ERTM SREJ list if init fails If the ERTM SREJ list is properly allocated but the retransmit list allocation fails, the SREJ list must be freed before returning from l2cap_ertm_init. l2cap_chan_del will not clean up the SREJ list if l2cap_ertm_init returns a failure code. Signed-off-by: Mat Martineau Signed-off-by: Marcel Holtmann --- diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 24f144b72a96..078bf805cd97 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -2381,7 +2381,11 @@ static inline int l2cap_ertm_init(struct l2cap_chan *chan) if (err < 0) return err; - return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win); + err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win); + if (err < 0) + l2cap_seq_list_free(&chan->srej_list); + + return err; } static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)