Commit 578658df authored May 28, 2019 by Tomas Bortoli Committed by Greg Kroah-Hartman Jul 26, 2019

Bluetooth: hci_bcsp: Fix memory leak in rx_skb



[ Upstream commit 4ce9146e0370fcd573f0372d9b4e5a211112567c ]

Syzkaller found that it is possible to provoke a memory leak by
never freeing rx_skb in struct bcsp_struct.

Fix by freeing in bcsp_close()

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by:  <syzbot+98162c885993b72f19c4@syzkaller.appspotmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 9d47bd21

drivers/bluetooth/hci_bcsp.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -759,6 +759,11 @@ static int bcsp_close(struct hci_uart *hu)
		skb_queue_purge(&bcsp->rel);
		skb_queue_purge(&bcsp->unrel);

		if (bcsp->rx_skb) {
		kfree_skb(bcsp->rx_skb);
		bcsp->rx_skb = NULL;
		}

		kfree(bcsp);
		return 0;
		}