diff options
| author | Jaganath Kanakkassery <jaganath.k.os@gmail.com> | 2017-10-25 10:58:48 +0530 |
|---|---|---|
| committer | Marcel Holtmann <marcel@holtmann.org> | 2017-10-29 14:07:10 +0100 |
| commit | f17d858ed0a48270db4368d8cf370e3839ee6f4f (patch) | |
| tree | 975b67fd9b1bf35c27320b25f11b8fa508d69a12 /net/bluetooth/mgmt.c | |
| parent | 858ff38af77fc660092e82474ecc6ac135ed29fe (diff) | |
Bluetooth: Fix potential memory leak
If command is added to req then it should be freed in case if
hdev is down or HCI_ADVERTISING flag is set.
This introduces a helper in hci_request to purge the cmd_q
to make cmd_q internal to hci_request which is used to fix
the leak.
This also replace accessing of cmd_q in hci_conn with the
new helper.
Signed-off-by: Jaganath Kanakkassery <jaganathx.kanakkassery@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Diffstat (limited to 'net/bluetooth/mgmt.c')
| -rw-r--r-- | net/bluetooth/mgmt.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c index 1fba2a03f8ae..07a3cc29f426 100644 --- a/net/bluetooth/mgmt.c +++ b/net/bluetooth/mgmt.c @@ -6383,6 +6383,7 @@ static int remove_advertising(struct sock *sk, struct hci_dev *hdev, if (skb_queue_empty(&req.cmd_q) || !hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING)) { + hci_req_purge(&req); rp.instance = cp->instance; err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, |