Commit 70f259a3 authored by Anant Thazhemadam's avatar Anant Thazhemadam Committed by Marcel Holtmann
Browse files

Bluetooth: hci_h5: close serdev device and free hu in h5_close 

When h5_close() gets called, the memory allocated for the hu gets
freed only if hu->serdev doesn't exist. This leads to a memory leak.
So when h5_close() is requested, close the serdev device instance and
free the memory allocated to the hu entirely instead.

Fixes: https://syzkaller.appspot.com/bug?extid=6ce141c55b2f7aafd1c4


Reported-by: default avatar <syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com>
Tested-by: default avatar <syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com>
Signed-off-by: default avatarAnant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 6dfccd13

drivers/bluetooth/hci_h5.c

+6 −2
Original line number Diff line number Diff line
@@ -248,8 +248,12 @@ static int h5_close(struct hci_uart *hu) 
	if (h5->vnd && h5->vnd->close)

		h5->vnd->close(h5);



	if (!hu->serdev)

	if (hu->serdev)

		serdev_device_close(hu->serdev);



	kfree_skb(h5->rx_skb);

	kfree(h5);

	h5 = NULL;



	return 0;

}