Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'for-net-2026-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth
Luiz Augusto von Dentz says:
====================
bluetooth pull request for net:
- hci_uart: fix null-ptr-deref in hci_uart_write_work
- MGMT: Fix memory leak in set_ssp_complete
* tag 'for-net-2026-01-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:
Bluetooth: MGMT: Fix memory leak in set_ssp_complete
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
====================
Link: https://patch.msgid.link/20260122200751.2950279-1-luiz.dentz@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+5
-2
+2
-2
drivers/bluetooth/hci_ldisc.c
+2
-2
drivers/bluetooth/hci_ldisc.c
···
685
685
return err;
686
686
}
687
687
688
+
set_bit(HCI_UART_PROTO_INIT, &hu->flags);
689
+
688
690
if (test_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags))
689
691
return 0;
690
692
···
713
711
return -EPROTONOSUPPORT;
714
712
715
713
hu->proto = p;
716
-
717
-
set_bit(HCI_UART_PROTO_INIT, &hu->flags);
718
714
719
715
err = hci_uart_register_dev(hu);
720
716
if (err) {
+3
net/bluetooth/mgmt.c
+3
net/bluetooth/mgmt.c
···
1966
1966
}
1967
1967
1968
1968
mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err);
1969
+
mgmt_pending_free(cmd);
1969
1970
return;
1970
1971
}
1971
1972
···
1985
1984
sock_put(match.sk);
1986
1985
1987
1986
hci_update_eir_sync(hdev);
1987
+
mgmt_pending_free(cmd);
1988
1988
}
1989
1989
1990
1990
static int set_ssp_sync(struct hci_dev *hdev, void *data)
···
6440
6438
hci_dev_clear_flag(hdev, HCI_ADVERTISING);
6441
6439
6442
6440
settings_rsp(cmd, &match);
6441
+
mgmt_pending_free(cmd);
6443
6442
6444
6443
new_settings(hdev, match.sk);
6445
6444