Re: [PATCH v2 2/2] Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

[Luiz Augusto von Dentz]

Hi Zijun,

On Tue, Sep 15, 2026 at 1:41 AM Zijun Hu <zijun.hu@xxxxxxxxxxxxxxxx> wrote:
>
> When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP
> without freeing its skb argument. This leaks the cloned skb and also
> prevents nxp_set_ind_reset() from being called to perform recovery.
>
> Fix by guarding hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)) with
> CONFIG_DEV_COREDUMP.
>
> Fixes: 998e447f443f ("Bluetooth: btnxpuart: Add support for HCI coredump feature")
> Signed-off-by: Zijun Hu <zijun.hu@xxxxxxxxxxxxxxxx>
> ---
>  drivers/bluetooth/btnxpuart.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/bluetooth/btnxpuart.c b/drivers/bluetooth/btnxpuart.c
> index 69e897444112..a0b64fdcbcc1 100644
> --- a/drivers/bluetooth/btnxpuart.c
> +++ b/drivers/bluetooth/btnxpuart.c
> @@ -1383,19 +1383,21 @@ static int nxp_process_fw_dump(struct hci_dev *hdev, struct sk_buff *skb)
>                 err = hci_devcd_init(hdev, NXP_FW_DUMP_SIZE);
>                 if (err < 0)
>                         goto free_skb;
>
>                 schedule_delayed_work(&hdev->dump.dump_timeout,
>                                       msecs_to_jiffies(20000));
>         }
>
> +#ifdef CONFIG_DEV_COREDUMP
>         err = hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC));
>         if (err < 0)
>                 goto free_skb;
> +#endif

I guess IS_ENABLED is preferable here so the code is still compiled in
leaving it up to the compiler to remove it in case it is considered
dead code.

>
>         if (buf_len == 0) {
>                 bt_dev_warn(hdev, "==== FW dump complete ===");
>                 hci_devcd_complete(hdev);
>                 nxp_set_ind_reset(hdev, NULL);
>         }
>
>  free_skb:
>
> --
> 2.34.1
>


-- 
Luiz Augusto von Dentz