Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 03bf4876 authored by Tomas Bortoli's avatar Tomas Bortoli Committed by Greg Kroah-Hartman
Browse files

Bluetooth: Fix invalid-free in bcsp_close() 



commit cf94da6f502d8caecabd56b194541c873c8a7a3c upstream.

Syzbot reported an invalid-free that I introduced fixing a memleak.

bcsp_recv() also frees bcsp->rx_skb but never nullifies its value.
Nullify bcsp->rx_skb every time it is freed.

Signed-off-by: default avatarTomas Bortoli <tomasbortoli@gmail.com>
Reported-by: default avatar <syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
Cc: Alexander Potapenko <glider@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 006360ec

drivers/bluetooth/hci_bcsp.c

+3 −0
Original line number Diff line number Diff line
@@ -606,6 +606,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count) 
			if (*ptr == 0xc0) {

				BT_ERR("Short BCSP packet");

				kfree_skb(bcsp->rx_skb);

				bcsp->rx_skb = NULL;

				bcsp->rx_state = BCSP_W4_PKT_START;

				bcsp->rx_count = 0;

			} else
@@ -621,6 +622,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count) 
			    bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {

				BT_ERR("Error in BCSP hdr checksum");

				kfree_skb(bcsp->rx_skb);

				bcsp->rx_skb = NULL;

				bcsp->rx_state = BCSP_W4_PKT_DELIMITER;

				bcsp->rx_count = 0;

				continue;
@@ -645,6 +647,7 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count) 
				       bscp_get_crc(bcsp));



				kfree_skb(bcsp->rx_skb);

				bcsp->rx_skb = NULL;

				bcsp->rx_state = BCSP_W4_PKT_DELIMITER;

				bcsp->rx_count = 0;

				continue;