Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3b166295 authored by Marcel Holtmann's avatar Marcel Holtmann Committed by Gustavo Padovan
Browse files

Bluetooth: Fix memory leak with L2CAP signal channels 



The wrong type of L2CAP signalling packets on the wrong type of
either BR/EDR or LE links need to be dropped. When that happens
the packet is dropped, but the memory not freed. So actually
free the memory as well.

Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Signed-off-by: default avatarGustavo Padovan <gustavo.padovan@collabora.co.uk>
parent 2ed01805

net/bluetooth/l2cap_core.c

+4 −2
Original line number Original line Diff line number Diff line
@@ -5330,7 +5330,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, 
	l2cap_raw_recv(conn, skb);

	l2cap_raw_recv(conn, skb);





	if (hcon->type != LE_LINK)

	if (hcon->type != LE_LINK)

		return;

		goto drop;





	while (len >= L2CAP_CMD_HDR_SIZE) {

	while (len >= L2CAP_CMD_HDR_SIZE) {

		u16 cmd_len;

		u16 cmd_len;
@@ -5363,6 +5363,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, 
		len  -= cmd_len;

		len  -= cmd_len;

	}

	}





drop:

	kfree_skb(skb);

	kfree_skb(skb);

}

}
@@ -5378,7 +5379,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, 
	l2cap_raw_recv(conn, skb);

	l2cap_raw_recv(conn, skb);





	if (hcon->type != ACL_LINK)

	if (hcon->type != ACL_LINK)

		return;

		goto drop;





	while (len >= L2CAP_CMD_HDR_SIZE) {

	while (len >= L2CAP_CMD_HDR_SIZE) {

		u16 cmd_len;

		u16 cmd_len;
@@ -5411,6 +5412,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn, 
		len  -= cmd_len;

		len  -= cmd_len;

	}

	}





drop:

	kfree_skb(skb);

	kfree_skb(skb);

}

}