In hci_rx_work(), HCI_DRV_PKT and HCI_DIAG_PKT rely on the default
case to free them, and cause:
- They get mixed in with unknown packet types (default case).
- It is not clear which packet types the function is handling.
Fix by giving both their own case that kfree_skb()s explicitly.
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
---
net/bluetooth/hci_core.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d1e78ae7728e..1e324c05af24 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -4057,6 +4057,14 @@ static void hci_rx_work(struct work_struct *work)
hci_isodata_packet(hdev, skb);
break;
+ case HCI_DRV_PKT:
+ kfree_skb(skb);
+ break;
+
+ case HCI_DIAG_PKT:
+ kfree_skb(skb);
+ break;
+
default:
kfree_skb(skb);
break;
---
base-commit: bd8bee79e1fa8db2d587733f8b6fd9597b04d6e3
change-id: 20260719-fix_hci_rx_work-f03dd49d8ef8
Best regards,
--
Zijun Hu <zijun.hu@oss.qualcomm.com>