shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-04 10:12:16 +09:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: hci_bcsp: Fix memory leak in rx_skb

Browse Source 
[ Upstream commit 4ce9146e03 ]

Syzkaller found that it is possible to provoke a memory leak by
never freeing rx_skb in struct bcsp_struct.

Fix by freeing in bcsp_close()

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+98162c885993b72f19c4@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Tomas Bortoli
2019-05-28 15:42:58 +02:00
committed by Greg Kroah-Hartman
parent 12fd5c11d3
commit 05b9c7b005
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/bluetooth/hci_bcsp.c
View File

@@ -757,6 +757,11 @@ static int bcsp_close(struct hci_uart *hu)
skb_queue_purge(&bcsp->rel);
skb_queue_purge(&bcsp->unrel);
if (bcsp->rx_skb) {
kfree_skb(bcsp->rx_skb);
bcsp->rx_skb = NULL;
}
kfree(bcsp);
return 0;
}