[PATCH] Bluetooth: btmtk: fix skb double free on ISO padding failure

[PATCH] Bluetooth: btmtk: fix skb double free on ISO padding failure

[Eric Dumazet]

btmtk_isopkt_pad() uses skb_pad(), which frees the skb on failure.

The error is propagated by alloc_mtk_intr_urb() and
btusb_send_frame_mtk() up to hci_send_frame(), which frees
the skb a second time:

	err = hdev->send(hdev, skb);
	if (err < 0) {
		bt_dev_err(hdev, "sending frame failed (%d)", err);
		kfree_skb(skb);
		return err;
	}

Use __skb_put_padto(skb, MTK_ISO_THRESHOLD, false) so that the skb
is left to the caller on error. This also replaces the open-coded
skb_pad() + __skb_put() sequence.

Fixes: ceac1cb0259d ("Bluetooth: btusb: mediatek: add ISO data transmission functions")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
 drivers/bluetooth/btmtk.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/drivers/bluetooth/btmtk.c b/drivers/bluetooth/btmtk.c
index 7ea8bcd8a7ecaa0122d96cc3787307301401e00f..c9175d478a9845bd476ad998815429d2748b78f2 100644
--- a/drivers/bluetooth/btmtk.c
+++ b/drivers/bluetooth/btmtk.c
@@ -1023,12 +1023,8 @@ static int btmtk_isopkt_pad(struct hci_dev *hdev, struct sk_buff *skb)
 	if (skb->len > MTK_ISO_THRESHOLD)
 		return -EINVAL;
 
-	if (skb_pad(skb, MTK_ISO_THRESHOLD - skb->len))
-		return -ENOMEM;
-
-	__skb_put(skb, MTK_ISO_THRESHOLD - skb->len);
-
-	return 0;
+	/* On error, the skb is freed by hci_send_frame(). */
+	return __skb_put_padto(skb, MTK_ISO_THRESHOLD, false);
 }
 
 static int __set_mtk_intr_interface(struct hci_dev *hdev)
-- 
2.53.0

Re: [PATCH] Bluetooth: btmtk: fix skb double free on ISO padding failure

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri,  9 Oct 2026 10:35:25 +0200 you wrote:
> btmtk_isopkt_pad() uses skb_pad(), which frees the skb on failure.
> 
> The error is propagated by alloc_mtk_intr_urb() and
> btusb_send_frame_mtk() up to hci_send_frame(), which frees
> the skb a second time:
> 
> 	err = hdev->send(hdev, skb);
> 	if (err < 0) {
> 		bt_dev_err(hdev, "sending frame failed (%d)", err);
> 		kfree_skb(skb);
> 		return err;
> 	}
> 
> [...]

Here is the summary with links:
  - Bluetooth: btmtk: fix skb double free on ISO padding failure
    https://git.kernel.org/bluetooth/bluetooth-next/c/2820ae3262bd

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html