[PATCH 40/60] Fix memory leak when double deletion happens and response code isn't SUCCESS

[Jose Antonio Santos Cadenas <santoscadenas@xxxxxxxxx>]

From: José Antonio Santos-Cadenas <santoscadenas@xxxxxxxxx>

---
 mcap/mcap.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/mcap/mcap.c b/mcap/mcap.c
index 51f0d87..64e76b5 100644
--- a/mcap/mcap.c
+++ b/mcap/mcap.c
@@ -1132,7 +1132,7 @@ static void process_md_delete_mdl_req(struct mcap_mcl *mcl, uint8_t *cmd,
 	notify = TRUE;
 	if (mdl->state == MDL_DELETING) {
 		/* Remote deviced requests deleting an MDL that upper profile
-		 * tries to delete, MDL will be freed when reply arrives. */
+		 * is trying to delete, MDL will be freed when reply arrives. */
 		mdl->mcl->cb->mdl_deleted(mdl, mdl->mcl->cb->user_data);
 	} else
 		mcap_delete_mdl(mdl, &notify);
@@ -1410,9 +1410,14 @@ static gboolean process_md_delete_mdl_rsp(struct mcap_mcl *mcl, uint8_t *cmd,
 						(rsp->rc == MCAP_INVALID_MDL)) {
 			/* Mdl does not exist in remote side */
 			goto del_mdl;
-		} else {
+		} else if (g_slist_find(mdl->mcl->mdls, mdl)){
 			/* this mdl couldn't be deleted */
 			restore_mdl(mdl, NULL);
+		} else {
+			/* MDL deleted request was sent by remote side while an
+			 * outgoing request for delete it was pending */
+			shutdown_mdl(mdl);
+			g_free(mdl);
 		}
 		goto end;
 	}
-- 
1.6.3.3

--
To unsubscribe from this list: send the line "unsubscribe linux-bluetooth" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html