[PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()
From: Zijun Hu
Date: Tue Sep 15 2026 - 01:42:09 EST
When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP
without freeing its skb argument. This leaks the cloned skb and also
prevents nxp_set_ind_reset() from being called to perform recovery.
Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
CONFIG_DEV_COREDUMP.
Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump feature")
Signed-off-by: Zijun Hu <zijun.hu@xxxxxxxxxxxxxxxx>
---
drivers/bluetooth/btnxpuart.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
index 69e897444112..a0b64fdcbcc1 100644
--- a/drivers/bluetooth/btnxpuart.c
+++ b/drivers/bluetooth/btnxpuart.c
@@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
if (err < 0)
goto free_skb;
schedule_delayed_work(&hdev->dump.dump_timeout,
msecs_to_jiffies(20000));
}
+#ifdef CONFIG_DEV_COREDUMP
err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
if (err < 0)
goto free_skb;
+#endif
if (buf_len == 0) {
bt_dev_warn(hdev, "==== FW dump complete ===");
hci_devcd_complete(hdev);
nxp_set_ind_reset(hdev, NULL);
}
free_skb:
--
2.34.1