Commit 21e4271e authored by Heitor Alves de Siqueira's avatar Heitor Alves de Siqueira Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: purge error queues in socket destructors 



When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued
into sk_error_queue and will stay there until consumed. If userspace never
gets to read the timestamps, or if the controller is removed unexpectedly,
these SKBs will leak.

Fix by adding skb_queue_purge() calls for sk_error_queue in affected
bluetooth destructors. RFCOMM does not currently use sk_error_queue.

Fixes: 134f4b39 ("Bluetooth: add support for skb TX SND/COMPLETION timestamping")
Reported-by: default avatar <syzbot+7ff4013eabad1407b70a@syzkaller.appspotmail.com>
Closes: https://syzbot.org/bug?extid=7ff4013eabad1407b70a


Cc: stable@vger.kernel.org
Signed-off-by: default avatarHeitor Alves de Siqueira <halves@igalia.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent c28d2bff

net/bluetooth/hci_sock.c

+1 −0
Original line number Diff line number Diff line
@@ -2166,6 +2166,7 @@ static void hci_sock_destruct(struct sock *sk) 
	mgmt_cleanup(sk);

	skb_queue_purge(&sk->sk_receive_queue);

	skb_queue_purge(&sk->sk_write_queue);

	skb_queue_purge(&sk->sk_error_queue);

}



static const struct proto_ops hci_sock_ops = {

net/bluetooth/iso.c

+1 −0
Original line number Diff line number Diff line
@@ -746,6 +746,7 @@ static void iso_sock_destruct(struct sock *sk) 


	skb_queue_purge(&sk->sk_receive_queue);

	skb_queue_purge(&sk->sk_write_queue);

	skb_queue_purge(&sk->sk_error_queue);

}



static void iso_sock_cleanup_listen(struct sock *parent)

net/bluetooth/l2cap_sock.c

+1 −0
Original line number Diff line number Diff line
@@ -1817,6 +1817,7 @@ static void l2cap_sock_destruct(struct sock *sk) 


	skb_queue_purge(&sk->sk_receive_queue);

	skb_queue_purge(&sk->sk_write_queue);

	skb_queue_purge(&sk->sk_error_queue);

}



static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,

net/bluetooth/sco.c

+1 −0
Original line number Diff line number Diff line
@@ -470,6 +470,7 @@ static void sco_sock_destruct(struct sock *sk) 


	skb_queue_purge(&sk->sk_receive_queue);

	skb_queue_purge(&sk->sk_write_queue);

	skb_queue_purge(&sk->sk_error_queue);

}



static void sco_sock_cleanup_listen(struct sock *parent)