Tomas Bortoli 0af768b0d6 Bluetooth: Fix invalid-free in bcsp_close() ...

commit cf94da6f50 upstream.

Syzbot reported an invalid-free that I introduced fixing a memleak.

bcsp_recv() also frees bcsp->rx_skb but never nullifies its value.
Nullify bcsp->rx_skb every time it is freed.

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Alexander Potapenko <glider@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2023-05-15 15:19:10 +09:00

..

ath3k.c

Bluetooth: Add another AR3012 04ca:3018 device

2017-03-15 10:02:40 +08:00

bcm203x.c

bluetooth: bcm203x: don't print error when allocating urb fails

2016-09-27 12:20:17 +02:00

bfusb.c

Bluetooth: bfusb: Fix the return error code

2015-12-22 15:25:33 +01:00

bluecard_cs.c

Bluetooth: Use new hci_skb_pkt_* wrappers for drivers

2015-11-19 17:50:27 +01:00

bpa10x.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2020-12-18 12:46:08 +09:00

bt3c_cs.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2020-12-18 12:46:08 +09:00

btbcm.c

Bluetooth: btbcm: Add entry for BCM4335C0 UART bluetooth

2023-05-15 09:19:39 +09:00

btbcm.h

Bluetooth: btbcm: Support the BCM4354 Bluetooth UART device

2015-06-17 18:56:53 +02:00

btintel.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2020-12-18 12:46:08 +09:00

btintel.h

Bluetooth: btintel: Create common Intel Version Read function

2015-12-10 00:51:51 +01:00

btmrvl_debugfs.c

Bluetooth: btmrvl add firmware dump support

2014-12-03 17:35:51 +01:00

btmrvl_drv.h

btmrvl: add platform specific wakeup interrupt support

2016-05-02 19:26:15 +02:00

btmrvl_main.c

Bluetooth: Rename HCI_BREDR into HCI_PRIMARY

2016-07-09 21:37:13 +03:00

btmrvl_sdio.c

btmrvl: avoid double-disable_irq() race

2017-10-21 17:21:38 +02:00

btmrvl_sdio.h

btmrvl: add platform specific wakeup interrupt support

2016-05-02 19:26:15 +02:00

btqca.c

Bluetooth: btqca: Add a short delay before downloading the NVM

2023-05-15 14:28:16 +09:00

btqca.h

Bluetooth: btqca: Introduce generic QCA ROME support

2015-08-10 23:52:20 +02:00

btqcomsmd.c

Bluetooth: btqcomsmd: Fix skb double free corruption

2018-03-24 11:00:22 +01:00

btrtl.c

Bluetooth: btrtl: Fix an issue that failing to download the FW which size is over 32K bytes

2020-12-18 12:47:54 +09:00

btrtl.h

Bluetooth: btrtl: HCI reset on close for Realtek BT chip

2020-12-18 12:47:06 +09:00

btsdio.c

Bluetooth: btsdio: Do not bind to non-removable BCM43341

2018-02-17 13:21:18 +01:00

btuart_cs.c

Bluetooth: Use new hci_skb_pkt_* wrappers for drivers

2015-11-19 17:50:27 +01:00

btusb.c

Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices

2023-05-15 14:32:15 +09:00

btwilink.c

Bluetooth: btwilink: Fix probe return value

2016-10-20 10:14:49 +02:00

dtl1_cs.c

Bluetooth: Use new hci_skb_pkt_* wrappers for drivers

2015-11-19 17:50:27 +01:00

hci_ag6xx.c

Bluetooth: hci_uart: Add diag and address support for Intel/AG6xx

2016-02-29 19:25:22 +02:00

hci_ath.c

Bluetooth: hci_uart: check for missing tty operations

2023-05-15 14:08:48 +09:00

hci_bcm.c

Bluetooth: hci_uart: check for missing tty operations

2023-05-15 14:08:48 +09:00

hci_bcsp.c

Bluetooth: Fix invalid-free in bcsp_close()

2023-05-15 15:19:10 +09:00

hci_h4.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2020-12-18 12:46:08 +09:00

hci_h5.c

Bluetooth: h5: Do not initialize Configuration field

2015-12-10 19:19:17 +01:00

hci_intel.c

Bluetooth: hci_uart: check for missing tty operations

2023-05-15 14:08:48 +09:00

hci_ldisc.c

Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()

2023-05-15 15:05:48 +09:00

hci_ll.c

Bluetooth: Use new hci_skb_pkt_* wrappers for drivers

2015-11-19 17:50:27 +01:00

hci_mrvl.c

Bluetooth: hci_uart: check for missing tty operations

2023-05-15 14:08:48 +09:00

hci_qca.c

Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning

2023-05-12 16:40:28 +09:00

hci_serdev.c

Bluetooth: Use bt_dev_err and bt_dev_info when possible

2020-12-18 12:46:08 +09:00

hci_uart.h

Bluetooth: hci_uart: check for missing tty operations

2023-05-15 14:08:48 +09:00

hci_vhci.c

miscdevice: Use module_misc_device() macro

2016-08-31 14:12:35 +02:00

Kconfig

Revert "Bluetooth: h5: Fix missing dependency on BT_HCIUART_SERDEV"

2023-05-15 09:51:44 +09:00

Makefile

Bluetooth: hci_uart: Add Marvell support

2016-09-19 20:32:03 +02:00