From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Date: Mon, 1 Jun 2026 18:45:42 +0000 (-0400)
Subject: Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=5cbf290b79351971f20c7a533247e8d58a3f970c;p=thirdparty%2Flinux.git

Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync

hci_get_route() returns a reference-counted hci_dev pointer via
hci_dev_hold(). The function exits normally or with an error without ever
releasing it.

Fixes: 07a9342b94a9 ("Bluetooth: ISO: Send BIG Create Sync via hci_sync")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
---

diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c
index 876649556d3c..3d707c43bdc0 100644
--- a/net/bluetooth/iso.c
+++ b/net/bluetooth/iso.c
@@ -1595,6 +1595,7 @@ static void iso_conn_big_sync(struct sock *sk)
 
 	release_sock(sk);
 	hci_dev_unlock(hdev);
+	hci_dev_put(hdev);
 }
 
 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg,