In 'hci_req_sync_complete()', always free the previous sync
request state before assigning reference to a new one.
Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=39ec16ff6cc18b1d066d
Cc: [email protected]
Fixes: f60cb30579d3 ("Bluetooth: Convert hci_req_sync family of function to new request API")
Signed-off-by: Dmitry Antipov <[email protected]>
---
net/bluetooth/hci_request.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index 00e02138003e..efea25eb56ce 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -105,8 +105,10 @@ void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
if (hdev->req_status == HCI_REQ_PEND) {
hdev->req_result = result;
hdev->req_status = HCI_REQ_DONE;
- if (skb)
+ if (skb) {
+ kfree_skb(hdev->req_skb);
hdev->req_skb = skb_get(skb);
+ }
wake_up_interruptible(&hdev->req_wait_q);
}
}
--
2.44.0
This is automated email and please do not reply to this email!
Dear submitter,
Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=840589
---Test result---
Test Summary:
CheckPatch PASS 0.69 seconds
GitLint PASS 0.33 seconds
SubjectPrefix PASS 0.13 seconds
BuildKernel PASS 30.16 seconds
CheckAllWarning PASS 33.20 seconds
CheckSparse PASS 38.58 seconds
CheckSmatch FAIL 35.20 seconds
BuildKernel32 PASS 29.20 seconds
TestRunnerSetup PASS 530.37 seconds
TestRunner_l2cap-tester PASS 18.32 seconds
TestRunner_iso-tester PASS 39.85 seconds
TestRunner_bnep-tester PASS 6.09 seconds
TestRunner_mgmt-tester PASS 111.56 seconds
TestRunner_rfcomm-tester PASS 7.41 seconds
TestRunner_sco-tester PASS 15.06 seconds
TestRunner_ioctl-tester PASS 8.04 seconds
TestRunner_mesh-tester PASS 5.91 seconds
TestRunner_smp-tester PASS 6.99 seconds
TestRunner_userchan-tester PASS 5.71 seconds
IncrementalBuild PASS 28.59 seconds
Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2
---
Regards,
Linux Bluetooth
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[email protected]>:
On Tue, 2 Apr 2024 14:32:05 +0300 you wrote:
> In 'hci_req_sync_complete()', always free the previous sync
> request state before assigning reference to a new one.
>
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=39ec16ff6cc18b1d066d
> Cc: [email protected]
> Fixes: f60cb30579d3 ("Bluetooth: Convert hci_req_sync family of function to new request API")
> Signed-off-by: Dmitry Antipov <[email protected]>
>
> [...]
Here is the summary with links:
- Bluetooth: fix memory leak in hci_req_sync_complete()
https://git.kernel.org/bluetooth/bluetooth-next/c/4d0d849bc5fd
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html