luck/tmp_suning_uos_patched
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Bluetooth: hci_bcsp: Fix memory leak in rx_skb

Browse Source 
Syzkaller found that it is possible to provoke a memory leak by
never freeing rx_skb in struct bcsp_struct.

Fix by freeing in bcsp_close()

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+98162c885993b72f19c4@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
This commit is contained in:
Tomas Bortoli 2019-05-28 15:42:58 +02:00 committed by Marcel Holtmann
parent 6c595ea8b7
commit 4ce9146e03
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/bluetooth/hci_bcsp.c
View File

@ -744,6 +744,11 @@ static int bcsp_close(struct hci_uart *hu)
skb_queue_purge(&bcsp->rel); skb_queue_purge(&bcsp->rel);
skb_queue_purge(&bcsp->unrel); skb_queue_purge(&bcsp->unrel);
if (bcsp->rx_skb) {
kfree_skb(bcsp->rx_skb);
bcsp->rx_skb = NULL;
}
kfree(bcsp); kfree(bcsp);
return 0; return 0;
} }