Bluetooth: fix memory leak in hci_req_sync_complete()

Commit Message

Dmitry Antipov April 2, 2024, 11:32 a.m. UTC

In 'hci_req_sync_complete()', always free the previous sync
request state before assigning reference to a new one.

Reported-by: [e-mail]
Closes: https://syzkaller.appspot.com/bug?extid=39ec16ff6cc18b1d066d
Cc: [e-mail]
Fixes: f60cb30579d3 ("Bluetooth: Convert hci_req_sync family of function to new request API")
Signed-off-by: Dmitry Antipov <[e-mail]>
---
 net/bluetooth/hci_request.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

[e-mail] April 2, 2024, 12:41 p.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=840589

---Test result---

Test Summary:
CheckPatch                    PASS      0.69 seconds
GitLint                       PASS      0.33 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      30.16 seconds
CheckAllWarning               PASS      33.20 seconds
CheckSparse                   PASS      38.58 seconds
CheckSmatch                   FAIL      35.20 seconds
BuildKernel32                 PASS      29.20 seconds
TestRunnerSetup               PASS      530.37 seconds
TestRunner_l2cap-tester       PASS      18.32 seconds
TestRunner_iso-tester         PASS      39.85 seconds
TestRunner_bnep-tester        PASS      6.09 seconds
TestRunner_mgmt-tester        PASS      111.56 seconds
TestRunner_rfcomm-tester      PASS      7.41 seconds
TestRunner_sco-tester         PASS      15.06 seconds
TestRunner_ioctl-tester       PASS      8.04 seconds
TestRunner_mesh-tester        PASS      5.91 seconds
TestRunner_smp-tester         PASS      6.99 seconds
TestRunner_userchan-tester    PASS      5.71 seconds
IncrementalBuild              PASS      28.59 seconds

Details
##############################
Test: CheckSmatch - FAIL
Desc: Run smatch tool with source
Output:

Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: net/bluetooth/hci_core.o] Error 139
make[4]: *** Deleting file 'net/bluetooth/hci_core.o'
make[3]: *** [scripts/Makefile.build:485: net/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: net] Error 2
make[2]: *** Waiting for unfinished jobs....
Segmentation fault (core dumped)
make[4]: *** [scripts/Makefile.build:244: drivers/bluetooth/bcm203x.o] Error 139
make[4]: *** Deleting file 'drivers/bluetooth/bcm203x.o'
make[4]: *** Waiting for unfinished jobs....
make[3]: *** [scripts/Makefile.build:485: drivers/bluetooth] Error 2
make[2]: *** [scripts/Makefile.build:485: drivers] Error 2
make[1]: *** [/github/workspace/src/src/Makefile:1919: .] Error 2
make: *** [Makefile:240: __sub-make] Error 2


---
Regards,
Linux Bluetooth

[e-mail] April 2, 2024, 4:01 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Tue,  2 Apr 2024 14:32:05 +0300 you wrote:
> In 'hci_req_sync_complete()', always free the previous sync
> request state before assigning reference to a new one.
> 
> Reported-by: [e-mail]
> Closes: https://syzkaller.appspot.com/bug?extid=39ec16ff6cc18b1d066d
> Cc: [e-mail]
> Fixes: f60cb30579d3 ("Bluetooth: Convert hci_req_sync family of function to new request API")
> Signed-off-by: Dmitry Antipov <[e-mail]>
> 
> [...]

Here is the summary with links:
  - Bluetooth: fix memory leak in hci_req_sync_complete()
    https://git.kernel.org/bluetooth/bluetooth-next/c/4d0d849bc5fd

You are awesome, thank you!

Patch

diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index 00e02138003e..efea25eb56ce 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -105,8 +105,10 @@  void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
 	if (hdev->req_status == HCI_REQ_PEND) {
 		hdev->req_result = result;
 		hdev->req_status = HCI_REQ_DONE;
-		if (skb)
+		if (skb) {
+			kfree_skb(hdev->req_skb);
 			hdev->req_skb = skb_get(skb);
+		}
 		wake_up_interruptible(&hdev->req_wait_q);
 	}
 }