diff options
| author |   Siwei Zhang <oss@fourdim.xyz> | 2026-05-20 22:30:36 -0400 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2026-05-27 16:44:01 -0400 |
| commit | 9dbd84990394c51f5cee1e8871bb5ff8af5ed939 (patch) | |
| tree | d1fa891eaea2eae104486d6a2e4e10cadfcf0cbe /include/linux/bcma/ssh:/git@git.zx2c4.com | |
| parent | Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (diff) | |
Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn
__set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold()
before scheduling the delayed work. The normal path in
l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the
end, but the early return when chan->conn is NULL skips the put,
leaking the reference.
Add the missing l2cap_chan_put() before the early return.
Fixes: adf0398cee86 ("Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout")
Cc: stable@vger.kernel.org
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'include/linux/bcma/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions