tree a097b6c736068852bd4b9b7ead795fb2bf398431
parent 4a34dcf258afd8854a4d4c2741fdad01e4e784f2
author Tomas Bortoli <tomasbortoli@gmail.com> 1572640964 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1574962142 +0100

Bluetooth: Fix invalid-free in bcsp_close()

commit cf94da6f502d8caecabd56b194541c873c8a7a3c upstream.

Syzbot reported an invalid-free that I introduced fixing a memleak.

bcsp_recv() also frees bcsp->rx_skb but never nullifies its value.
Nullify bcsp->rx_skb every time it is freed.

Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com>
Reported-by: syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Cc: Alexander Potapenko <glider@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>