Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn

__set_chan_timer() takes a l2cap_chan reference via l2cap_chan_hold()
before scheduling the delayed work.  The normal path in
l2cap_chan_timeout() drops this reference with l2cap_chan_put() at the
end, but the early return when chan->conn is NULL skips the put,
leaking the reference.

Add the missing l2cap_chan_put() before the early return.

Fixes: adf0398cee86 ("Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout")
Cc: stable@vger.kernel.org
Signed-off-by: Siwei Zhang <oss@fourdim.xyz>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index fdccd62ccca8f91a41149e12e7fe7dd035e7a7ec..5668c92b3f58d3397e7d787df493ef0660918dd2 100644 (file)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -411,8 +411,10 @@ static void l2cap_chan_timeout(struct work_struct *work)
 
        BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
-       if (!conn)
+       if (!conn) {
+               l2cap_chan_put(chan);
                return;
+       }
 
        mutex_lock(&conn->lock);
        /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling