[PATCH 1/2] Bluetooth: MGMT: free remove monitor command on cancel

[Jiale Yao]

remove_adv_monitor() allocates its queued command with
mgmt_pending_new(), so the command is not linked into
hdev->mgmt_pending. If the command-sync entry is cancelled, its
completion callback returns without freeing the command, leaking both
the allocation and its socket reference.

Free the pending command before returning from the cancellation path.

Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 net/bluetooth/mgmt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 251a896babd5..e54a838aeada 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -5682,8 +5682,10 @@ static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev,
 	struct mgmt_pending_cmd *cmd = data;
 	struct mgmt_cp_remove_adv_monitor *cp;
 
-	if (status == -ECANCELED)
+	if (status == -ECANCELED) {
+		mgmt_pending_free(cmd);
 		return;
+	}
 
 	hci_dev_lock(hdev);
 
-- 
2.34.1