Hi Alexander, >>> Syzbot reported an invalid-free that I introduced fixing a memleak. >>> >>> bcsp_recv() also frees bcsp->rx_skb but never nullifies its value. >>> Nullify bcsp->rx_skb every time it is freed. >>> >>> Signed-off-by: Tomas Bortoli <tomasbortoli@xxxxxxxxx> >>> Reported-by: syzbot+a0d209a4676664613e76@xxxxxxxxxxxxxxxxxxxxxxxxx >>> --- >>> drivers/bluetooth/hci_bcsp.c | 3 +++ >>> 1 file changed, 3 insertions(+) >> >> patch has been applied to bluetooth-next tree. > I believe this bug requires stable tags, as it can potentially provide > an arbitrary write (via __skb_unlink) and is triggerable locally with > user privileges. I do not have a reproducer for it, but if you do, feel free to propose it for -stable inclusion. Regards Marcel
