From 1d0688421449718c6c5f46e458a378c9b530ba18 Mon Sep 17 00:00:00 2001
From: Soenke Huster <soenke.huster@eknoes.de>
Date: Wed, 20 Oct 2021 10:14:44 +0200
Subject: [PATCH] Bluetooth: virtio_bt: fix memory leak in virtbt_rx_handle()
Git-commit: 1d0688421449718c6c5f46e458a378c9b530ba18
Patch-mainline: v5.17-rc1
References: CVE-2022-26878 bsc#1197035 git-fixes
On the reception of packets with an invalid packet type, the memory of
the allocated socket buffers is never freed. Add a default case that frees
these to avoid a memory leak.
Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
drivers/bluetooth/virtio_bt.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 57908ce4fae8..076e4942a3f0 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -202,6 +202,9 @@ static void virtbt_rx_handle(struct virtio_bluetooth *vbt, struct sk_buff *skb)
hci_skb_pkt_type(skb) = pkt_type;
hci_recv_frame(vbt->hdev, skb);
break;
+ default:
+ kfree_skb(skb);
+ break;
}
}
--
2.31.1