| From c2c374acbf11cc490691eb9510499fd06290a3ea Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sun, 15 Mar 2026 10:51:37 +0000 |
| Subject: Bluetooth: hci_ll: Fix firmware leak on error path |
| |
| From: Anas Iqbal <mohd.abd.6602@gmail.com> |
| |
| [ Upstream commit 31148a7be723aa9f2e8fbd62424825ab8d577973 ] |
| |
| Smatch reports: |
| |
| drivers/bluetooth/hci_ll.c:587 download_firmware() warn: |
| 'fw' from request_firmware() not released on lines: 544. |
| |
| In download_firmware(), if request_firmware() succeeds but the returned |
| firmware content is invalid (no data or zero size), the function returns |
| without releasing the firmware, resulting in a resource leak. |
| |
| Fix this by calling release_firmware() before returning when |
| request_firmware() succeeded but the firmware content is invalid. |
| |
| Fixes: 371805522f87 ("bluetooth: hci_uart: add LL protocol serdev driver support") |
| Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de> |
| Signed-off-by: Anas Iqbal <mohd.abd.6602@gmail.com> |
| Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/bluetooth/hci_ll.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c |
| index 4a0b5c3160c2b..4d987dece2d0c 100644 |
| --- a/drivers/bluetooth/hci_ll.c |
| +++ b/drivers/bluetooth/hci_ll.c |
| @@ -541,6 +541,8 @@ static int download_firmware(struct ll_device *lldev) |
| if (err || !fw->data || !fw->size) { |
| bt_dev_err(lldev->hu.hdev, "request_firmware failed(errno %d) for %s", |
| err, bts_scr_name); |
| + if (!err) |
| + release_firmware(fw); |
| return -EINVAL; |
| } |
| ptr = (void *)fw->data; |
| -- |
| 2.51.0 |
| |
