Bluetooth: mgmt: Fix double free on error path

Dan Carpenter · Vudentz · commit 4b2f4e072fb2 · 2022-07-26T13:32:40.000-07:00
Don't call mgmt_pending_remove() twice (double free). Fixes: 6b88eff ("Bluetooth: hci_sync: Refactor remove Adv Monitor") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
@@ -4723,7 +4723,6 @@ static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev,
 		else
 			status = MGMT_STATUS_FAILED;
 
-		mgmt_pending_remove(cmd);
 		goto unlock;
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -4723,7 +4723,6 @@ static int __add_adv_patterns_monitor(struct sock sk, struct hci_dev hdev,`
`4723`	`4723`	`else`
`4724`	`4724`	`status = MGMT_STATUS_FAILED;`
`4725`	`4725`
`4726`		`- mgmt_pending_remove(cmd);`
`4727`	`4726`	`goto unlock;`
`4728`	`4727`	`}`
`4729`	`4728`