Received-SPF: pass (google.com: domain of linux-bluetooth-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) client-ip=2620:137:e000::3:6;
From:   Yuran Pereira <yuran.pereira@hotmail.com>
To:     marcel@holtmann.org
Cc:     Yuran Pereira <yuran.pereira@hotmail.com>, johan.hedberg@gmail.com,
        gregkh@linuxfoundation.org, luiz.dentz@gmail.com,
        linux-kernel-mentees@lists.linuxfoundation.org,
        linux-kernel@vger.kernel.org, linux-bluetooth@vger.kernel.org,
        syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com
Subject: [PATCH] Bluetooth: hci_conn_failed: Fix memory leak
Date:   Sun,  8 Oct 2023 11:33:34 +0530
Message-ID: <AM9P192MB1267F1B8CA16CEEF884C9F2CE8CFA@AM9P192MB1267.EURP192.PROD.OUTLOOK.COM>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AM9P192MB1267:EE_|DU0P192MB1572:EE_
X-MS-Office365-Filtering-Correlation-Id: 442700bc-53ff-4c1d-e475-08dbc7c45e9c
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: q3U/0gC+jH3mTpv0DWyuHCxN+Yo0w1Ab1O7CFIySJI16JfD+skWx2w07ioyRk96knDX0YNoba7dkVkRghwf7nHABV1BO5J6H1vNEXwr8nH3dsFKVk9d1jk+wd644ZM/0oSx90XmSFaR/TrLxZWMK0hBUCV5YR9+5/6b5wCQdYv1cNOigtVSKMaPKnwcp30rFLNmASiyivEgjLI4kncJ6ErPKInLkiNRYl/sw29AThm6YryDaAvjjnObtpi6EFZ1YW1RNMfZ0YYa0sekE3Ywcm2GYYelssSqBojalTfzbZ259XbGSxXTfpu5AW9u114Xeibo1APqC/JXF9P2K5AYJCW2ImDB0SrAiOXTt+lCoW2AgC73cW7tw7hXkeG2HKHsRE4D0zDR7fvTv5O3w26esGIks+Md1AComxxI3LprSNpng6rGOuq0JM0hZ/RWwkUiAURi69gIQIiC4DNoHtfMGvi1V+gIsXm89tn2yldZxEhwGiTOkhOiKcHUN8IhPeJTRyZqHJZ7xIRx2Qd7855AVP0gkw+DYD9o9ahlq7Bnq42A1rQ6GbYlcD35zLhstoVUeXIYNMPZuQpiRhzUyVluLSg6Oz2PXZFfz2YWj2JalY3DqDzeg54K6ExLAv+bHAmpK
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?T2mF8Zm3enWKy4t5D2pGaNhpH4iyd2ahdqnPpapnQ9lqF3SJKh6rER0tqz2+?=
 =?us-ascii?Q?qBcQ8TF328xEiamWZ+qVBxFKF2e7iRGzaJ57lUvKJ6dYvKDN5KKu5SxC+ykZ?=
 =?us-ascii?Q?wtpI7lkXwCtuPukVz4WigVkqZ+lIz9+txqlvSLLq+y9UHuOkfGnr5FYo4Cyc?=
 =?us-ascii?Q?j59Zn+l3vZdKZgZdGVtIJlviUpDGs3O5+lLtTuLaqDPx+tJy7LzrsfHRnr0p?=
 =?us-ascii?Q?W/vP3kTxteThw5amTuQk08XJM7aFUlaQsxqiL3xpGVgJWkekDA8Yvd9/zEVW?=
 =?us-ascii?Q?SjKT8B4Yv5CrtKR54bGLjkBPYdplKhiFUxW3qC1Hy9qKcADEQ8sQmJ3tA9M8?=
 =?us-ascii?Q?Qjf746C9TVW5xF9enTIFlbiPbZr65v3cSV/uxCqWAaeYD3R6dE5vlhY6gnLs?=
 =?us-ascii?Q?1kCR9wRIJNJ34VCGOcNUezwNQNkmvirBmn43aE24tkcOYWLnqgfA5wQI9uPl?=
 =?us-ascii?Q?mOk7+CpbV3bhBIAzL0ksRa0gloIsRry6WCYHT9G2GjT2esIppbhzckv5VkYJ?=
 =?us-ascii?Q?3NUPpES6Zchx/KW08HFmBFa6+zXeoVjiGkW0ZJBY6z3xWt94U63ueU/+K0ys?=
 =?us-ascii?Q?/jyi/IhfLa+xAphxI9DBLlQY0emVKpz1H7WIdwLgF9Cz/r2dyCHQas/qYdk4?=
 =?us-ascii?Q?ep68D7RuUfaG+wYt2o/sN5IHvetnIi4CAfV/wH5DWSrfohBIRVWsxGFrLsOR?=
 =?us-ascii?Q?4LCenIT0o/9Gv2NJkDHDftCyvaqeNsa8NcuWimXYH0fbQxMMx+GfqKfUuFUK?=
 =?us-ascii?Q?vL/iydXe068w1OzIOUmBhk/H4eS/ZQ98V4oP03iSko2TB1Lwp1cxAkOzggiS?=
 =?us-ascii?Q?MN3TR6Tg9SdZGRJF/37XHWl/wSnbX94qJMKWfTrwdJIuEts0Z11FXbKQQpt9?=
 =?us-ascii?Q?/g1o4YdaiEfpltjQCX2JoXshC05pAXAdm59RsEbqapNq1OQh+pqLt2nCPb5N?=
 =?us-ascii?Q?xzjclBkr3ZQoYjUeqsHgK0hYvmog4WNQe6BdfVAaC7KpBdX+WE4AEEfzOdpp?=
 =?us-ascii?Q?wNf+5I2kwB8YD+vxJfqSSsdtLVjiA8PRPjlvgbGhFcb+2O38Mc89KVsaKBWQ?=
 =?us-ascii?Q?jnGesb3dn/nBWVzRRqt3uCcg6hSheMauMDy1S/A/59dyjSzRW70+pxitxxB6?=
 =?us-ascii?Q?Tqm6o9kvnFgLd5VJPtrAyeZlFQBp4VuiAV8pUg6t6/vqsG6+5d0Dh4ZCGNCF?=
 =?us-ascii?Q?+gyp1hLY4H9lve5bVRwcF5Havbe1I1QqQk8EESxi9Vx36LZGeAQlU8HXWls?=
 =?us-ascii?Q?=3D?=
X-OriginatorOrg: sct-15-20-4755-11-msonline-outlook-fb43a.templateTenant
X-MS-Exchange-CrossTenant-Network-Message-Id: 442700bc-53ff-4c1d-e475-08dbc7c45e9c
X-MS-Exchange-CrossTenant-AuthSource: AM9P192MB1267.EURP192.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Oct 2023 06:04:02.9871
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0P192MB1572
X-Spam-Status: No, score=4.1 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,FORGED_HOTMAIL_RCVD2,FREEMAIL_FORGED_FROMDOMAIN,
	FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	RCVD_IN_SBL_CSS,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no
	version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on pete.vger.email
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (pete.vger.email [0.0.0.0]); Sat, 07 Oct 2023 23:04:21 -0700 (PDT)
X-Spam-Level: ****

The hci_conn_failed() function currently calls hci_connect_cfm(), which
indirectly leads to the allocation of an l2cap_conn struct in 
l2cap_conn_add().
This operation results in a memory leak, as the l2cap_conn structure
becomes unreferenced.

To address this issue and prevent the memory leak, this patch modifies
hci_conn_failed() to replace the call to hci_connect_cfm() with a
call to hci_disconn_cfm().

Fixes: 9b3628d79b46 ("Bluetooth: hci_sync: Cleanup hci_conn if it cannot be aborted")
Reported-by: syzbot+39ec16ff6cc18b1d066d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=39ec16ff6cc18b1d066d
Signed-off-by: Yuran Pereira <yuran.pereira@hotmail.com>
---
 net/bluetooth/hci_conn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 7a6f20338db8..1d2d03b4a98a 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1248,7 +1248,7 @@ void hci_conn_failed(struct hci_conn *conn, u8 status)
 	}
 
 	conn->state = BT_CLOSED;
-	hci_connect_cfm(conn, status);
+	hci_disconn_cfm(conn, status);
 	hci_conn_del(conn);
 }
 
-- 
2.25.1