| commit | cf94da6f502d8caecabd56b194541c873c8a7a3c | [log] [tgz] |
|---|---|---|
| author | Tomas Bortoli <tomasbortoli@gmail.com> | Fri Nov 01 21:42:44 2019 +0100 |
| committer | Marcel Holtmann <marcel@holtmann.org> | Mon Nov 04 15:19:02 2019 +0100 |
| tree | eeb6c8ad29126b87eea3880256f326ea10901a1f | |
| parent | 41d5b25fed0a010cedbdd25e56fdb92d59c233fa [diff] |
Bluetooth: Fix invalid-free in bcsp_close() Syzbot reported an invalid-free that I introduced fixing a memleak. bcsp_recv() also frees bcsp->rx_skb but never nullifies its value. Nullify bcsp->rx_skb every time it is freed. Signed-off-by: Tomas Bortoli <tomasbortoli@gmail.com> Reported-by: syzbot+a0d209a4676664613e76@syzkaller.appspotmail.com Signed-off-by: Marcel Holtmann <marcel@holtmann.org>