projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 41d5b25) | patch
Bluetooth: Fix invalid-free in bcsp_close()
authorTomas Bortoli <tomasbortoli@gmail.com>
Fri, 1 Nov 2019 20:42:44 +0000 (21:42 +0100)
committerMarcel Holtmann <marcel@holtmann.org>
Mon, 4 Nov 2019 14:19:02 +0000 (15:19 +0100)
commitcf94da6f502d8caecabd56b194541c873c8a7a3c
treeeeb6c8ad29126b87eea3880256f326ea10901a1ftree | snapshot
parent41d5b25fed0a010cedbdd25e56fdb92d59c233facommit | diff
Bluetooth: Fix invalid-free in bcsp_close()

Syzbot reported an invalid-free that I introduced fixing a memleak.

bcsp_recv() also frees bcsp->rx_skb but never nullifies its value.
Nullify bcsp->rx_skb every time it is freed.

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
drivers/bluetooth/hci_bcsp.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git