* [PATCH] Bluetooth: Fix memory leak with L2CAP signal channels
@ 2013-10-02 15:28 Marcel Holtmann
2013-10-02 20:22 ` Gustavo Padovan
0 siblings, 1 reply; 2+ messages in thread
From: Marcel Holtmann @ 2013-10-02 15:28 UTC (permalink / raw)
To: linux-bluetooth
The wrong type of L2CAP signalling packets on the wrong type of
either BR/EDR or LE links need to be dropped. When that happens
the packet is dropped, but the memory not freed. So actually
free the memory as well.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
---
net/bluetooth/l2cap_core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 6d42498..814563d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5330,7 +5330,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
l2cap_raw_recv(conn, skb);
if (hcon->type != LE_LINK)
- return;
+ goto drop;
while (len >= L2CAP_CMD_HDR_SIZE) {
u16 cmd_len;
@@ -5363,6 +5363,7 @@ static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
len -= cmd_len;
}
+drop:
kfree_skb(skb);
}
@@ -5378,7 +5379,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
l2cap_raw_recv(conn, skb);
if (hcon->type != ACL_LINK)
- return;
+ goto drop;
while (len >= L2CAP_CMD_HDR_SIZE) {
u16 cmd_len;
@@ -5411,6 +5412,7 @@ static inline void l2cap_sig_channel(struct l2cap_conn *conn,
len -= cmd_len;
}
+drop:
kfree_skb(skb);
}
--
1.8.3.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] Bluetooth: Fix memory leak with L2CAP signal channels
2013-10-02 15:28 [PATCH] Bluetooth: Fix memory leak with L2CAP signal channels Marcel Holtmann
@ 2013-10-02 20:22 ` Gustavo Padovan
0 siblings, 0 replies; 2+ messages in thread
From: Gustavo Padovan @ 2013-10-02 20:22 UTC (permalink / raw)
To: Marcel Holtmann; +Cc: linux-bluetooth
Hi Marcel,
2013-10-02 Marcel Holtmann <marcel@holtmann.org>:
> The wrong type of L2CAP signalling packets on the wrong type of
> either BR/EDR or LE links need to be dropped. When that happens
> the packet is dropped, but the memory not freed. So actually
> free the memory as well.
>
> Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
> ---
> net/bluetooth/l2cap_core.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
Patch has been applied to bluetooth-next. Thanks.
Gustavo
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-10-02 20:22 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-02 15:28 [PATCH] Bluetooth: Fix memory leak with L2CAP signal channels Marcel Holtmann
2013-10-02 20:22 ` Gustavo Padovan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).