From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Date: Tue, 28 Oct 2025 17:56:30 +0000 (+0530)
Subject: Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()
X-Git-Tag: v6.12.58~55
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0545cc1a4a02066a5807c58361894bb5d2561fa8;p=thirdparty%2Fkernel%2Fstable.git

Bluetooth: btrtl: Fix memory leak in rtlbt_parse_firmware_v2()

[ Upstream commit 1c21cf89a66413eb04b2d22c955b7a50edc14dfa ]

The memory allocated for ptr using kvmalloc() is not freed on the last
error path. Fix that by freeing it on that error path.

Fixes: 9a24ce5e29b1 ("Bluetooth: btrtl: Firmware format v2 support")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 59eb948664223..c4431c5976b40 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -625,8 +625,10 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 		len += entry->len;
 	}
 
-	if (!len)
+	if (!len) {
+		kvfree(ptr);
 		return -EPERM;
+	}
 
 	*_buf = ptr;
 	return len;