diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2026-03-19 16:49:38 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-03-19 16:49:38 -0700 |
| commit | 57ce3b2e9cdabcbc4d5a10f0e97a1399058c7417 (patch) | |
| tree | 91375155b0354483e73e300429659ea73ebaed83 /drivers | |
| parent | cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed (diff) | |
| parent | 761fb8ec8778f0caf2bba5a41e3cff1ea86974f3 (diff) | |
Merge tag 'for-net-2026-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
- hci_ll: Fix firmware leak on error path
- hci_sync: annotate data-races around hdev->req_status
- L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
- L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
- L2CAP: Fix regressions caused by reusing ident
- L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
- MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
- SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
* tag 'for-net-2026-03-19' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: L2CAP: Fix regressions caused by reusing ident
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Bluetooth: hci_ll: Fix firmware leak on error path
Bluetooth: hci_sync: annotate data-races around hdev->req_status
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
====================
Link: https://patch.msgid.link/20260319190455.135302-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/bluetooth/hci_ll.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c index 91acf24f1ef5..91c96ad12342 100644 --- a/drivers/bluetooth/hci_ll.c +++ b/drivers/bluetooth/hci_ll.c @@ -541,6 +541,8 @@ static int download_firmware(struct ll_device *lldev) if (err || !fw->data || !fw->size) { bt_dev_err(lldev->hu.hdev, "request_firmware failed(errno %d) for %s", err, bts_scr_name); + if (!err) + release_firmware(fw); return -EINVAL; } ptr = (void *)fw->data; |