Bluetooth: Fix memory leak with L2CAP signal channels
authorMarcel Holtmann <marcel@holtmann.org>
Wed, 2 Oct 2013 15:28:21 +0000 (08:28 -0700)
committerGustavo Padovan <gustavo.padovan@collabora.co.uk>
Wed, 2 Oct 2013 20:17:05 +0000 (17:17 -0300)
The wrong type of L2CAP signalling packets on the wrong type of
either BR/EDR or LE links need to be dropped. When that happens
the packet is dropped, but the memory not freed. So actually
free the memory as well.

Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
net/bluetooth/l2cap_core.c

index 6d42498e862b2abc5ff43b399f63e3b043ebca0e..814563d15476b96dde65b928cae5bdf66841475d 100644 (file)
@@ -5330,7 +5330,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
        l2cap_raw_recv(conn, skb);
 
        if (hcon->type != LE_LINK)
-               return;
+               goto drop;
 
        while (len >= L2CAP_CMD_HDR_SIZE) {
                u16 cmd_len;
@@ -5363,6 +5363,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
                len  -= cmd_len;
        }
 
+drop:
        kfree_skb(skb);
 }
 
@@ -5378,7 +5379,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
        l2cap_raw_recv(conn, skb);
 
        if (hcon->type != ACL_LINK)
-               return;
+               goto drop;
 
        while (len >= L2CAP_CMD_HDR_SIZE) {
                u16 cmd_len;
@@ -5411,6 +5412,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
                len  -= cmd_len;
        }
 
+drop:
        kfree_skb(skb);
 }