From: Pauli Virtanen <pav@iki.fi>
Date: Mon, 22 Sep 2025 18:11:21 +0000 (+0300)
Subject: Bluetooth: ISO: free rx_skb if not consumed
X-Git-Tag: v6.12.53~59
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cd4d126706d0299f4dd40ae3d74e64f392cccda5;p=thirdparty%2Fkernel%2Fstable.git

Bluetooth: ISO: free rx_skb if not consumed

[ Upstream commit 6ba85da5804efffe15c89b03742ea868f20b4172 ]

If iso_conn is freed when RX is incomplete, free any leftover skb piece.

Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index df21c79800fb6..e38f52638627d 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -111,6 +111,8 @@ static void iso_conn_free(struct kref *ref)
 	/* Ensure no more work items will run since hci_conn has been dropped */
 	disable_delayed_work_sync(&conn->timeout_work);
 
+	kfree_skb(conn->rx_skb);
+
 	kfree(conn);
 }