Commit 4ce9146e authored May 28, 2019 by Tomas Bortoli Committed by Marcel Holtmann Jul 06, 2019

Bluetooth: hci_bcsp: Fix memory leak in rx_skb



Syzkaller found that it is possible to provoke a memory leak by
never freeing rx_skb in struct bcsp_struct.

Fix by freeing in bcsp_close()

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by:  <syzbot+98162c885993b72f19c4@syzkaller.appspotmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

parent 6c595ea8

drivers/bluetooth/hci_bcsp.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -744,6 +744,11 @@ static int bcsp_close(struct hci_uart *hu)
		skb_queue_purge(&bcsp->rel);
		skb_queue_purge(&bcsp->unrel);

		if (bcsp->rx_skb) {
		kfree_skb(bcsp->rx_skb);
		bcsp->rx_skb = NULL;
		}

		kfree(bcsp);
		return 0;
		}

Admin message