Re: [PATCH 1/4] Bluetooth: coredump: Fix skb leak in hci_devcd_append() stub

[Luiz Augusto von Dentz]

Hi Zijun,

On Sun, Sep 13, 2026 at 11:43 PM Zijun Hu <zijun.hu@xxxxxxxxxxxxxxxx> wrote:
>
> For hci_devcd_append(hdev, skb):
> it consumes the skb when CONFIG_DEV_COREDUMP=y, but its stub does not free
> the skb. this inconsistency causes skb leak when CONFIG_DEV_COREDUMP=n.
>
> NXP btuart device driver encounters this leak:
>
> btnxpuart.c:
> nxp_process_fw_dump(hdev, skb)
> {
>         ...
>         // the skb_clone() is leaked.
>         err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
>         if (err < 0)
>                 goto free_skb;
>         ...
> free_skb:
>         kfree_skb(skb);         /* frees the original, not the clone */
>         return 0;
> }
>
> Fix by freeing the skb in the stub to keep consistent behavior.
>
> Fixes: 9695ef876fd1 ("Bluetooth: Add support for hci devcoredump")
> Signed-off-by: Zijun Hu <zijun.hu@xxxxxxxxxxxxxxxx>
> ---
>  include/net/bluetooth/coredump.h | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/include/net/bluetooth/coredump.h b/include/net/bluetooth/coredump.h
> index acc1849f66c0..07940a1d5dd4 100644
> --- a/include/net/bluetooth/coredump.h
> +++ b/include/net/bluetooth/coredump.h
> @@ -103,16 +103,17 @@ static inline int hci_devcd_register(struct hci_dev *hdev, coredump_t coredump,
>
>  static inline int hci_devcd_init(struct hci_dev *hdev, u32 dump_size)
>  {
>         return -EOPNOTSUPP;
>  }
>
>  static inline int hci_devcd_append(struct hci_dev *hdev, struct sk_buff *skb)
>  {
> +       kfree_skb(skb);

I don't think freeing it here is a good idea; in fact I think the bug
must be fixed in the caller so it properly frees all clones, etc,
actually it may need to check if hci_devcd_init fails and stops
cloning and calling hci_devcd_append as a result.

>         return -EOPNOTSUPP;
>  }
>
>  static inline int hci_devcd_append_pattern(struct hci_dev *hdev,
>                                            u8 pattern, u32 len)
>  {
>         return -EOPNOTSUPP;
>  }
>
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz