From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Fri, 4 Feb 2022 21:12:35 +0000 (-0800)
Subject: Bluetooth: hci_core: Fix leaking sent_cmd skb
X-Git-Tag: accepted/tizen/unified/20230118.172025~1584
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=3679ccc09d8806686d579095ed504e045af7f7d6;p=platform%2Fkernel%2Flinux-rpi.git

Bluetooth: hci_core: Fix leaking sent_cmd skb

[ Upstream commit dd3b1dc3dd050f1f47cd13e300732852414270f8 ]

sent_cmd memory is not freed before freeing hci_dev causing it to leak
it contents.

Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 53f1b080..c673903 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4083,6 +4083,7 @@ void hci_release_dev(struct hci_dev *hdev)
 	hci_dev_unlock(hdev);
 
 	ida_simple_remove(&hci_index_ida, hdev->id);
+	kfree_skb(hdev->sent_cmd);
 	kfree(hdev);
 }
 EXPORT_SYMBOL(hci_release_dev);