mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 21:03:32 +00:00
Bluetooth: Fix memory leak in hci_req_sync_complete()
commit45d355a926
upstream. In 'hci_req_sync_complete()', always free the previous sync request state before assigning reference to a new one. Reported-by: syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=39ec16ff6cc18b1d066d Cc: stable@vger.kernel.org Fixes:f60cb30579
("Bluetooth: Convert hci_req_sync family of function to new request API") Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
53e494b7bc
commit
75193678cc
1 changed files with 3 additions and 1 deletions
|
@ -108,8 +108,10 @@ static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
|
||||||
if (hdev->req_status == HCI_REQ_PEND) {
|
if (hdev->req_status == HCI_REQ_PEND) {
|
||||||
hdev->req_result = result;
|
hdev->req_result = result;
|
||||||
hdev->req_status = HCI_REQ_DONE;
|
hdev->req_status = HCI_REQ_DONE;
|
||||||
if (skb)
|
if (skb) {
|
||||||
|
kfree_skb(hdev->req_skb);
|
||||||
hdev->req_skb = skb_get(skb);
|
hdev->req_skb = skb_get(skb);
|
||||||
|
}
|
||||||
wake_up_interruptible(&hdev->req_wait_q);
|
wake_up_interruptible(&hdev->req_wait_q);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue