Bluetooth: Fix memory leak with L2CAP signal channels
The wrong type of L2CAP signalling packets on the wrong type of
either BR/EDR or LE links need to be dropped. When that happens
the packet is dropped, but the memory not freed. So actually
free the memory as well.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 6d42498..814563d 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -5330,7 +5330,7 @@
l2cap_raw_recv(conn, skb);
if (hcon->type != LE_LINK)
- return;
+ goto drop;
while (len >= L2CAP_CMD_HDR_SIZE) {
u16 cmd_len;
@@ -5363,6 +5363,7 @@
len -= cmd_len;
}
+drop:
kfree_skb(skb);
}
@@ -5378,7 +5379,7 @@
l2cap_raw_recv(conn, skb);
if (hcon->type != ACL_LINK)
- return;
+ goto drop;
while (len >= L2CAP_CMD_HDR_SIZE) {
u16 cmd_len;
@@ -5411,6 +5412,7 @@
len -= cmd_len;
}
+drop:
kfree_skb(skb);
}