]> git.ipfire.org Git - thirdparty/linux.git/commit
Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()
authorPavitra Jha <jhapavitra98@gmail.com>
Thu, 21 May 2026 08:04:14 +0000 (04:04 -0400)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Wed, 27 May 2026 20:44:01 +0000 (16:44 -0400)
commitbfa9d28960ed677d556bdf097073bc3129686229
treea738d6bf14482f60a067f16d8246be2243310424
parentab1513597c6cf17cd1ad2a21e3b045421b48e022
Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but
returns 0 without freeing it when neither pa_sync_term nor big_sync_term
flags are set after evaluating the PA and BIG sync connection state.

This early-return path was introduced when hci_le_big_terminate() was
refactored to take struct hci_conn instead of raw u8 parameters, adding
PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue
failure does not cover this path.

Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections")
Cc: stable@vger.kernel.org
Signed-off-by: Pavitra Jha <jhapavitra98@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
net/bluetooth/hci_conn.c