From: Pauli Virtanen <pav@iki.fi>
Date: Mon, 22 Sep 2025 18:11:22 +0000 (+0300)
Subject: Bluetooth: ISO: don't leak skb in ISO_CONT RX
X-Git-Tag: v6.18-rc1~132^2~26^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5bf863f4c5da055c1eb08887ae4f26d99dbc4aac;p=thirdparty%2Flinux.git

Bluetooth: ISO: don't leak skb in ISO_CONT RX

For ISO_CONT RX, the data from skb is copied to conn->rx_skb, but the
skb is leaked.

Free skb after copying its data.

Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index ad5c8118a6e3d..9b263d061e051 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -2427,7 +2427,7 @@ void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
 					  skb->len);
 		conn->rx_len -= skb->len;
-		return;
+		break;
 
 	case ISO_END:
 		skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),