[PATCH 1/4] Bluetooth: coredump: Fix skb leak in hci_devcd_append() stub

[Zijun Hu]

For hci_devcd_append(hdev, skb):
it consumes the skb when CONFIG_DEV_COREDUMP=y, but its stub does not free
the skb. this inconsistency causes skb leak when CONFIG_DEV_COREDUMP=n.

NXP btuart device driver encounters this leak:

btnxpuart.c:
nxp_process_fw_dump(hdev, skb)
{
	...
	// the skb_clone() is leaked.
	err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
	if (err < 0)
		goto free_skb;
	...
free_skb:
	kfree_skb(skb);		/* frees the original, not the clone */
	return 0;
}

Fix by freeing the skb in the stub to keep consistent behavior.

Fixes: 9695ef876fd1 ("Bluetooth: Add support for hci devcoredump")
Signed-off-by: Zijun Hu <zijun.hu@xxxxxxxxxxxxxxxx>
---
 include/net/bluetooth/coredump.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/net/bluetooth/coredump.h b/include/net/bluetooth/coredump.h
index acc1849f66c0..07940a1d5dd4 100644
--- a/include/net/bluetooth/coredump.h
+++ b/include/net/bluetooth/coredump.h
@@ -103,16 +103,17 @@ static inline int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump,
 
 static inline int hci_devcd_init(struct hci_dev *hdev, u32 dump_size)
 {
 	return -EOPNOTSUPP;
 }
 
 static inline int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb)
 {
+	kfree_skb(skb);
 	return -EOPNOTSUPP;
 }
 
 static inline int hci_devcd_append_pattern(struct hci_dev *hdev,
 					   u8 pattern, u32 len)
 {
 	return -EOPNOTSUPP;
 }

-- 
2.34.1