Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7;
From:   Yuran Pereira <yuran.pereira@hotmail.com>
To:     marcel@holtmann.org
Cc:     Yuran Pereira <yuran.pereira@hotmail.com>, johan.hedberg@gmail.com,
        luiz.dentz@gmail.com, linux-bluetooth@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        linux-kernel-mentees@lists.linuxfoundation.org,
        syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com
Subject: [PATCH] Bluetooth: hci_conn_failed: Fixes memory leak
Date:   Sat,  7 Oct 2023 17:09:01 +0530
Message-ID: <AM9P192MB12672AA34A0480B522D23741E8C8A@AM9P192MB1267.EURP192.PROD.OUTLOOK.COM>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AM9P192MB1267:EE_|DB5P192MB2197:EE_
X-MS-Office365-Filtering-Correlation-Id: 0ba6f99a-0493-41d7-56f5-08dbc72a0ecb
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: aSRWJLKdLfkn/gmXV567fc7b47eIUCYdxc+B4XVS9NljW7Pqx+pRkr2+bDuzroH1rMca9Q/Yohbwz/1PuCkO1qS7QoN4LCFAJ5Rb5Toi91I/QSRs9N6anOtngh9Mrl4Y6EdF9BvMEfq14iBP/SosImZ5gDE7HR6Zky9beifj6rqTqeJeZ9Z4NDlhMjzY/GtqWKGJc6MQwXvnJdgGEjv0MnpBScOqZTASroyRobzCBBWvFEI8D+nU87N9p/zeolGYhwg9OSTtUjoaNOIBsEZsWf5i0F/1nZJ/04siZi91pBNAnDhAbtjdRLUPsVJW43if8/2M5BzqOBIu20HltUiOssuL9NzXLZY/vP/eR7g2M+DkJ7A+H1kzTbRYgiikr0eyD2oHTIBdIu8STzBSKe7n6EcA/t+wkK+egbIGDAttJACvHJNlyVTcYZfZZ0jd9Dv0LCrT/zBHEM0tk7Gl5Paw6TtlxTauf4yaPCaB3zej2lN/heM9WFR/7Rfy/kPy3cR3Nr0PzBIcGaQyBp7BHSWillnuc4HxQ1/iuA4VoI4zXCcSiifDCepfDBN91fJFbe4WeA8c1H6/0lG0eufn3233RSOEatTfWIQzRrmfKJA9V/iSDGVysH0FIFJmAS6VpdrE
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?9C+g7i+d25tDpTPrMi5n9n1iJRUGyfLa9GofXmclFdm8wpU7bPrc9tsrGRKF?=
 =?us-ascii?Q?QoEsyGkHtM7OgKvnHamg+Pq5ngJKu5gsZSTyp05jkGhqvGBOZsTz4ZGCVZw0?=
 =?us-ascii?Q?TdGLJ1vwxwlUzA4UzxW6hraxPfUdoeBHMEburQtuvJQ0k8lG/7Ko7CMGiY1/?=
 =?us-ascii?Q?mcuYSLfNSBNic/AahO2XDBtxUVWo0xjGmduCU2yQPdhlI1k6R6fXxLFEn4Si?=
 =?us-ascii?Q?wi6IJ8RFw2sc1+Pd/jhf6u9c2xlQ+YSnx+T4GwzCRxFCMP9b8AVHjuE5ZG9B?=
 =?us-ascii?Q?fLRRmSsZ86ITLOz/GYfGDgUlB7Pfaa6BjavodWSOsC7WjkjEZzNDO8A46Y5S?=
 =?us-ascii?Q?+3Qt1qnwuUcS784zAVXnjuSRS6vXfl3+UfZNDU81T/26bx+g8DXEeyTSRrr1?=
 =?us-ascii?Q?xtuOM0gGI+LTPNcTwINUbbkMcwUfEwDLHUYphAO/i19OvCQi5Kx56SVZ/tN1?=
 =?us-ascii?Q?TkzFiudPrRS63y9/G1bej76qUJDVh5oPnLBASt6Yo7gfq77tupDnN+xeGiDX?=
 =?us-ascii?Q?Guei6XlvNgek0S864URAZxzgrEltXfy6/YBBxiIk+tV12OS9j2Iq8TcfpUKU?=
 =?us-ascii?Q?OBmwevZJz1HpTSlYkH2vdyvQ5da4VbtO9+R2qPjqhzFejV1N5Y4bkPRHD1YO?=
 =?us-ascii?Q?WyJ31fefrnGwJPi/mU6tHuCoDBC7gE8cbKVyhe3+qZkngKT+09U63cqGjr9n?=
 =?us-ascii?Q?a7wm31fpW/nXBTLSrE3XAy9w92uIjGNZoWVE3r5fYPEU919EXG16EvTVClLP?=
 =?us-ascii?Q?1CBulP5PMRmrbUUq9KZC5CfrnGR3dxxIlTbJuR80uzDZ0DOHydyy5/RgQZRa?=
 =?us-ascii?Q?t2IS6OP3TdoMt5S51DGgSdCrB709jeXzwITUgfD35S5K3qA6lPsbNOVdPPDc?=
 =?us-ascii?Q?AlPfnpE0M4beuu83DqzJ5hY6LrdJHFgpeS+QwCMtaqQ1EMntn72v5T4mqIS/?=
 =?us-ascii?Q?ffumKg7Qq/HRL79s5rKx4RdQastNEw39aNpxbpRAbcvTCLLXkIECFAo9eSfA?=
 =?us-ascii?Q?zsoS0FU68gKeMh72nqi9Jj6h61HJdoMQVrjPwmQUoCndWsekncpVAvKqMs4x?=
 =?us-ascii?Q?HPHDiybN3MavVu3VN5nRa+uGVMI/d3Yc5Rzf9Vmp+jLo2hPLTnGTpeSbZZQv?=
 =?us-ascii?Q?zfoW+3LueIJPL5E2o+rb2tPX0p9DIjRng+/pEvt71LVE9opJdKEHRg01dyg+?=
 =?us-ascii?Q?PHgf4gWkUBy1I2Uh6UKlhIPpDq4gt43NESvf9RBxkY2GCFrLTlZ+PQ1NKOs?=
 =?us-ascii?Q?=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-fb43a.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: 0ba6f99a-0493-41d7-56f5-08dbc72a0ecb
X-MS-Exchange-CrossTenant-AuthSource: AM9P192MB1267.EURP192.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2023 11:39:26.5978
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB5P192MB2197
X-Spam-Status: No, score=-2.5 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,
        RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_PASS
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Sat, 07 Oct 2023 04:39:34 -0700 (PDT)

The hci_conn_failed() function currently calls hci_connect_cfm(), which
indirectly leads to the allocation of an l2cap_conn struct in l2cap_conn_add().
This operation results in a memory leak, as the l2cap_conn structure
becomes unreferenced.

To address this issue and prevent the memory leak, this patch modifies
hci_conn_failed() to replace the call to hci_connect_cfm() with a
call to hci_disconn_cfm().

Reported-by: syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com
Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
---
 net/bluetooth/hci_conn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 7a6f20338db8..1d2d03b4a98a 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1248,7 +1248,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)
 	}
 
 	conn->state = BT_CLOSED;
-	hci_connect_cfm(conn, status);
+	hci_disconn_cfm(conn, status);
 	hci_conn_del(conn);
 }
 
-- 
2.25.1