Bluetooth: hci_h5: close serdev device and free hu in h5_close
authorAnant Thazhemadam <anant.thazhemadam@gmail.com>
Tue, 29 Sep 2020 18:58:15 +0000 (00:28 +0530)
committerMarcel Holtmann <marcel@holtmann.org>
Mon, 9 Nov 2020 12:09:43 +0000 (13:09 +0100)
commit70f259a3f4276b71db365b1d6ff1eab805ea6ec3
tree6335200543924fd567f806efa9ffe352a87679f5
parent6dfccd13db2ff2b709ef60a50163925d477549aa
Bluetooth: hci_h5: close serdev device and free hu in h5_close

When h5_close() gets called, the memory allocated for the hu gets
freed only if hu->serdev doesn't exist. This leads to a memory leak.
So when h5_close() is requested, close the serdev device instance and
free the memory allocated to the hu entirely instead.

Fixes: https://syzkaller.appspot.com/bug?extid=6ce141c55b2f7aafd1c4
Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
drivers/bluetooth/hci_h5.c