Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18e1101b authored by Anant Thazhemadam's avatar Anant Thazhemadam Committed by Greg Kroah-Hartman
Browse files

Bluetooth: hci_h5: close serdev device and free hu in h5_close 

commit 70f259a3f4276b71db365b1d6ff1eab805ea6ec3 upstream.

When h5_close() gets called, the memory allocated for the hu gets
freed only if hu->serdev doesn't exist. This leads to a memory leak.
So when h5_close() is requested, close the serdev device instance and
free the memory allocated to the hu entirely instead.

Fixes: https://syzkaller.appspot.com/bug?extid=6ce141c55b2f7aafd1c4


Reported-by: default avatar <syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com>
Signed-off-by: default avatarAnant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b726f860

drivers/bluetooth/hci_h5.c

+6 −2
Original line number Diff line number Diff line
@@ -250,8 +250,12 @@ static int h5_close(struct hci_uart *hu) 
	if (h5->vnd && h5->vnd->close)

		h5->vnd->close(h5);



	if (!hu->serdev)

	if (hu->serdev)

		serdev_device_close(hu->serdev);



	kfree_skb(h5->rx_skb);

	kfree(h5);

	h5 = NULL;



	return 0;

}