[PW_SID:1168176] Bluetooth: hci_core: Fix leak of request command on tx timeout - #786
BluezTestBot wants to merge 1 commit into
Conversation
When a command transmission times out, hci_cmd_timeout() calls hci_cmd_sync_cancel_sync() to mark the pending request as HCI_REQ_CANCELED and wake up the waiter. However, nothing releases the request command skb in this path: hci_cmd_sync_complete(), the only place which frees hdev->req_skb during normal operation, bails out early because the request status is no longer HCI_REQ_PEND. Since commit f5afdff ("Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb"), hdev->req_skb holds an extra reference to the same skb object as hdev->sent_cmd, so both pointers keep the buffer alive and it leaks unless the device is closed, which a fuzzer never does. This is the leak reported by kmemleak as "memory leak in __hci_cmd_sync_sk". Free the request command and the last sent command on the timeout path and clear HCI_CMD_PENDING, mirroring the cleanup done by hci_dev_close_sync(). This is safe because the waiter has already been woken up and later command completion events tolerate a NULL sent_cmd/req_skb via the hci_cmd_data() NULL checks. Fixes: 63298d6 ("Bluetooth: hci_core: Cancel request on command timeout") Signed-off-by: Jiakai Xu <xujiakai24@mails.ucas.ac.cn>
|
CheckPatch |
|
VerifyFixes |
|
VerifySignedoff |
|
GitLint |
|
SubjectPrefix |
|
BuildKernel |
|
CheckAllWarning |
|
CheckSparse |
|
BuildKernel32 |
|
CheckKernelLLVM |
|
TestRunnerSetup |
|
TestRunner_l2cap-tester |
|
TestRunner_iso-tester |
|
TestRunner_bnep-tester |
|
TestRunner_mgmt-tester |
|
TestRunner_rfcomm-tester |
|
TestRunner_sco-tester |
|
TestRunner_ioctl-tester |
|
TestRunner_mesh-tester |
|
TestRunner_smp-tester |
|
TestRunner_userchan-tester |
|
TestRunner_6lowpan-tester |
|
IncrementalBuild |
2 participants
When a command transmission times out, hci_cmd_timeout() calls
hci_cmd_sync_cancel_sync() to mark the pending request as
HCI_REQ_CANCELED and wake up the waiter. However, nothing releases
the request command skb in this path: hci_cmd_sync_complete(), the
only place which frees hdev->req_skb during normal operation, bails
out early because the request status is no longer HCI_REQ_PEND.
Since commit f5afdff ("Bluetooth: hci_core: use skb_get()
instead of skb_clone() for req_skb"), hdev->req_skb holds an extra
reference to the same skb object as hdev->sent_cmd, so both pointers
keep the buffer alive and it leaks unless the device is closed,
which a fuzzer never does. This is the leak reported by kmemleak as
"memory leak in __hci_cmd_sync_sk".
Free the request command and the last sent command on the timeout
path and clear HCI_CMD_PENDING, mirroring the cleanup done by
hci_dev_close_sync(). This is safe because the waiter has already
been woken up and later command completion events tolerate a NULL
sent_cmd/req_skb via the hci_cmd_data() NULL checks.
Fixes: 63298d6 ("Bluetooth: hci_core: Cancel request on command timeout")
Signed-off-by: Jiakai Xu xujiakai24@mails.ucas.ac.cn
net/bluetooth/hci_core.c | 12 ++++++++++++
1 file changed, 12 insertions(+)