[PATCH BlueZ v3 0/6] OOB Authentication improvements

[PATCH BlueZ v3 0/6] OOB Authentication improvements

[Brian Gix]

This patch set fixes some minor bugs, and adds explicit support for all
currently supported Provisioning authentication methods.

v2: Added prov-acceptor queuing, and fixed whitespace issues

v3: Fixed spelling errors and added patch to address memory leak

Brian Gix (6):
  mesh: Fix delivery of PB-ACK to acceptors
  mesh: Normalize endian of public/private ECC keys
  tools/mesh: Add all supported OOB methods to cfgclient
  test/mesh: Add support for testing more OOB auth
  mesh: Add single threading to prov-acp ob messaging
  mesh: Fix race condition memory leak

 mesh/mesh-io-generic.c |  2 +
 mesh/pb-adv.c          |  1 -
 mesh/prov-acceptor.c   | 96 +++++++++++++++++++++++++++---------------
 mesh/prov-initiator.c  |  3 ++
 mesh/provision.h       |  1 +
 test/agent.py          | 23 ++++++++++
 tools/mesh-cfgclient.c | 32 +++++++++++---
 7 files changed, 118 insertions(+), 40 deletions(-)

-- 
2.25.4

[PATCH BlueZ v3 1/6] mesh: Fix delivery of PB-ACK to acceptors

[Brian Gix]

Remove unneeded initialization that prevented the Acceptor roll of ever
recognizing a valid PB-ACK.
---
 mesh/pb-adv.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/mesh/pb-adv.c b/mesh/pb-adv.c
index c74dae79f..83f922aa8 100644
--- a/mesh/pb-adv.c
+++ b/mesh/pb-adv.c
@@ -358,7 +358,6 @@ static void pb_adv_packet(void *user_data, const uint8_t *pkt, uint16_t len)
 		first = !session->link_id;
 		session->link_id = link_id;
 		session->last_peer_trans_num = 0xFF;
-		session->local_acked = 0xFF;
 		session->peer_trans_num = 0x00;
 		session->local_trans_num = 0x7F;
 		session->opened = true;
-- 
2.25.4

RE: OOB Authentication improvements

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1953 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=485263

---Test result---

Test Summary:
CheckPatch                    PASS      1.29 seconds
GitLint                       PASS      0.62 seconds
Prep - Setup ELL              PASS      41.03 seconds
Build - Prep                  PASS      0.10 seconds
Build - Configure             PASS      7.17 seconds
Build - Make                  PASS      173.70 seconds
Make Check                    PASS      9.14 seconds
Make Distcheck                PASS      204.37 seconds
Build w/ext ELL - Configure   PASS      7.15 seconds
Build w/ext ELL - Make        PASS      163.44 seconds

Details
##############################
Test: CheckPatch - PASS
Desc: Run checkpatch.pl script with rule in .checkpatch.conf

##############################
Test: GitLint - PASS
Desc: Run gitlint with rule in .gitlint

##############################
Test: Prep - Setup ELL - PASS
Desc: Clone, build, and install ELL

##############################
Test: Build - Prep - PASS
Desc: Prepare environment for build

##############################
Test: Build - Configure - PASS
Desc: Configure the BlueZ source tree

##############################
Test: Build - Make - PASS
Desc: Build the BlueZ source tree

##############################
Test: Make Check - PASS
Desc: Run 'make check'

##############################
Test: Make Distcheck - PASS
Desc: Run distcheck to check the distribution

##############################
Test: Build w/ext ELL - Configure - PASS
Desc: Configure BlueZ source with '--enable-external-ell' configuration

##############################
Test: Build w/ext ELL - Make - PASS
Desc: Build BlueZ source with '--enable-external-ell' configuration



---
Regards,
Linux Bluetooth

[PATCH BlueZ v3 2/6] mesh: Normalize endian of public/private ECC keys

[Brian Gix]

The Mesh profile specification defines a Mesh byte order of Big Endian
for Public keys used to calculate shared secrets. Further the
specification sample data also show this same byte order for Private
keys.  However, our internal ECDH shared secret calculation requires
Little Endian byte ordering. This fixes our DBus interface, and
debugging output to use Mesh Byte Ordering (Big Endian) for all human
readable input/output.
---
 mesh/prov-acceptor.c  | 8 +++++++-
 mesh/prov-initiator.c | 3 +++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/mesh/prov-acceptor.c b/mesh/prov-acceptor.c
index e806b12ef..0dbb84f50 100644
--- a/mesh/prov-acceptor.c
+++ b/mesh/prov-acceptor.c
@@ -223,7 +223,11 @@ static bool acp_credentials(struct mesh_prov_acceptor *prov)
 
 	print_packet("PublicKeyProv", prov->conf_inputs.prv_pub_key, 64);
 	print_packet("PublicKeyDev", prov->conf_inputs.dev_pub_key, 64);
+
+	/* Normalize for debug out -- No longer needed for calculations */
+	swap_u256_bytes(prov->private_key);
 	print_packet("PrivateKeyLocal", prov->private_key, 32);
+
 	print_packet("ConfirmationInputs", &prov->conf_inputs,
 						sizeof(prov->conf_inputs));
 	print_packet("ECDHSecret", prov->secret, 32);
@@ -307,11 +311,13 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
 		return;
 	}
 
+	/* API delivers Mesh byte order, switch to little endian */
+	swap_u256_bytes(key);
 	memcpy(prov->private_key, key, 32);
 	ecc_make_public_key(prov->private_key,
 			prov->conf_inputs.dev_pub_key);
 
-	/* Convert to Mesh byte order */
+	/* Convert Public key to Mesh byte order */
 	swap_u256_bytes(prov->conf_inputs.dev_pub_key);
 	swap_u256_bytes(prov->conf_inputs.dev_pub_key + 32);
 
diff --git a/mesh/prov-initiator.c b/mesh/prov-initiator.c
index ae9c646de..c62577523 100644
--- a/mesh/prov-initiator.c
+++ b/mesh/prov-initiator.c
@@ -222,6 +222,9 @@ static bool int_credentials(struct mesh_prov_initiator *prov)
 
 	print_packet("PublicKeyProv", prov->conf_inputs.prv_pub_key, 64);
 	print_packet("PublicKeyDev", prov->conf_inputs.dev_pub_key, 64);
+
+	/* Print DBG out in Mesh order */
+	swap_u256_bytes(prov->private_key);
 	print_packet("PrivateKeyLocal", prov->private_key, 32);
 	print_packet("ConfirmationInputs", &prov->conf_inputs,
 						sizeof(prov->conf_inputs));
-- 
2.25.4

[PATCH BlueZ v3 3/6] tools/mesh: Add all supported OOB methods to cfgclient

[Brian Gix]

To support the widest range of mesh devices, we need to support any
possible capability combinations that a remote device may request.
---
 tools/mesh-cfgclient.c | 32 +++++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/tools/mesh-cfgclient.c b/tools/mesh-cfgclient.c
index 49069674f..a4a6f21ab 100644
--- a/tools/mesh-cfgclient.c
+++ b/tools/mesh-cfgclient.c
@@ -104,7 +104,17 @@ static struct model_info *cfgcli;
 static struct l_queue *devices;
 
 static bool prov_in_progress;
-static const char *caps[] = {"static-oob", "out-numeric", "in-numeric"};
+static const char * const caps[] = {"static-oob",
+				"push",
+				"twist",
+				"blink",
+				"beep",
+				"vibrate",
+				"public-oob",
+				"out-alpha",
+				"in-alpha",
+				"out-numeric",
+				"in-numeric"};
 
 static bool have_config;
 
@@ -419,7 +429,7 @@ static void agent_input_done(oob_type_t type, void *buf, uint16_t len,
 	struct l_dbus_message *reply = NULL;
 	struct l_dbus_message_builder *builder;
 	uint32_t val_u32;
-	uint8_t oob_data[16];
+	uint8_t oob_data[64];
 
 	switch (type) {
 	case NONE:
@@ -435,15 +445,15 @@ static void agent_input_done(oob_type_t type, void *buf, uint16_t len,
 		/* Fall Through */
 
 	case HEXADECIMAL:
-		if (len > 16) {
+		if (len > sizeof(oob_data)) {
 			bt_shell_printf("Bad input length\n");
 			break;
 		}
-		memset(oob_data, 0, 16);
+		memset(oob_data, 0, sizeof(oob_data));
 		memcpy(oob_data, buf, len);
 		reply = l_dbus_message_new_method_return(msg);
 		builder = l_dbus_message_builder_new(reply);
-		append_byte_array(builder, oob_data, 16);
+		append_byte_array(builder, oob_data, len);
 		l_dbus_message_builder_finalize(builder);
 		l_dbus_message_builder_destroy(builder);
 		break;
@@ -580,6 +590,16 @@ static struct l_dbus_message *prompt_numeric_call(struct l_dbus *dbus,
 	return NULL;
 }
 
+static struct l_dbus_message *prompt_public_call(struct l_dbus *dbus,
+						struct l_dbus_message *msg,
+						void *user_data)
+{
+	l_dbus_message_ref(msg);
+	agent_input_request(HEXADECIMAL, 64, "Enter 512 bit Public Key",
+			agent_input_done, msg);
+	return NULL;
+}
+
 static struct l_dbus_message *prompt_static_call(struct l_dbus *dbus,
 						struct l_dbus_message *msg,
 						void *user_data)
@@ -618,6 +638,8 @@ static void setup_agent_iface(struct l_dbus_interface *iface)
 						"u", "s", "number", "type");
 	l_dbus_interface_method(iface, "PromptStatic", 0, prompt_static_call,
 						"ay", "s", "data", "type");
+	l_dbus_interface_method(iface, "PublicKey", 0, prompt_public_call,
+							"ay", "", "data");
 }
 
 static bool register_agent(void)
-- 
2.25.4

[PATCH BlueZ v3 4/6] test/mesh: Add support for testing more OOB auth

[Brian Gix]

To pass IOP testing, we need to be able to support Input OOB and Out of
band Public Key exchange,  This patch adds agent methods to support
those capabilities, but are turned off because the test code uses
insecure fixed values instead of randomized values.
---
 test/agent.py | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/test/agent.py b/test/agent.py
index b46cd95f4..57a74183d 100755
--- a/test/agent.py
+++ b/test/agent.py
@@ -35,7 +35,9 @@ class Agent(dbus.service.Object):
 		caps = []
 		oob = []
 		caps.append('out-numeric')
+		#caps.append('in-numeric') -- Do not use well known in-oob
 		caps.append('static-oob')
+		#caps.append('public-oob') -- Do not use well known key pairs
 		oob.append('other')
 		return {
 			AGENT_IFACE: {
@@ -56,6 +58,27 @@ class Agent(dbus.service.Object):
 		print(set_cyan('DisplayNumeric ('), type,
 				set_cyan(') number ='), set_green(value))
 
+	@dbus.service.method(AGENT_IFACE, in_signature="s", out_signature="u")
+	def PromptNumeric(self, type):
+		# Sample in-oob -- DO-NOT-USE
+		value = 12345
+		print(set_cyan('PromptNumeric ('), type,
+				set_cyan(') number ='), set_green(value))
+		return dbus.UInt32(value)
+
+	@dbus.service.method(AGENT_IFACE, in_signature="", out_signature="ay")
+	def PrivateKey(self):
+		# Sample Public/Private pair from Mesh Profile Spec DO-NOT-USE
+		private_key_str = '6872b109ea0574adcf88bf6da64996a4624fe018191d9322a4958837341284bc'
+		public_key_str = 'ce9027b5375fe5d3ed3ac89cef6a8370f699a2d3130db02b87e7a632f15b0002e5b72c775127dc0ce686002ecbe057e3d6a8000d4fbf2cdfffe0d38a1c55a043'
+		print(set_cyan('PrivateKey ()'))
+		print(set_cyan('Enter Public key on remote device: '),
+										set_green(public_key_str));
+		private_key = bytearray.fromhex(private_key_str)
+
+		return dbus.Array(private_key, signature='y')
+
+
 	@dbus.service.method(AGENT_IFACE, in_signature="s", out_signature="ay")
 	def PromptStatic(self, type):
 		static_key = numpy.random.randint(0, 255, 16)
-- 
2.25.4

[PATCH BlueZ v3 5/6] mesh: Add single threading to prov-acp ob messaging

[Brian Gix]

Certain IOP and stress testing scenarios can cause additional outbound
messages to be attempted before the prior outbound message completes.
This patch adds queuing if outbpund messages are attempted too quickly
so that the additional message is not sent until the prior message is
ACKed.
---
 mesh/prov-acceptor.c | 88 +++++++++++++++++++++++++++-----------------
 mesh/provision.h     |  1 +
 2 files changed, 56 insertions(+), 33 deletions(-)

diff --git a/mesh/prov-acceptor.c b/mesh/prov-acceptor.c
index 0dbb84f50..f579a143b 100644
--- a/mesh/prov-acceptor.c
+++ b/mesh/prov-acceptor.c
@@ -42,26 +42,15 @@ static const uint16_t expected_pdu_size[] = {
 
 #define BEACON_TYPE_UNPROVISIONED		0x00
 
+struct deferred_cmd {
+	uint16_t len;
+	uint8_t cmd[];
+};
+
 static const uint8_t pkt_filter = MESH_AD_TYPE_PROVISION;
 static const uint8_t bec_filter[] = {MESH_AD_TYPE_BEACON,
 						BEACON_TYPE_UNPROVISIONED};
 
-enum acp_state {
-	ACP_PROV_IDLE = 0,
-	ACP_PROV_CAPS_SENT,
-	ACP_PROV_CAPS_ACKED,
-	ACP_PROV_KEY_SENT,
-	ACP_PROV_KEY_ACKED,
-	ACP_PROV_INP_CMPLT_SENT,
-	ACP_PROV_INP_CMPLT_ACKED,
-	ACP_PROV_CONF_SENT,
-	ACP_PROV_CONF_ACKED,
-	ACP_PROV_RAND_SENT,
-	ACP_PROV_RAND_ACKED,
-	ACP_PROV_CMPLT_SENT,
-	ACP_PROV_FAIL_SENT,
-};
-
 #define MAT_REMOTE_PUBLIC	0x01
 #define MAT_LOCAL_PRIVATE	0x02
 #define MAT_RAND_AUTH		0x04
@@ -70,12 +59,13 @@ enum acp_state {
 struct mesh_prov_acceptor {
 	mesh_prov_acceptor_complete_func_t cmplt;
 	prov_trans_tx_t trans_tx;
+	struct l_queue *ob;
 	void *agent;
 	void *caller_data;
 	void *trans_data;
 	struct l_timeout *timeout;
 	uint32_t to_secs;
-	enum acp_state	state;
+	uint8_t out_opcode;
 	uint8_t transport;
 	uint8_t material;
 	uint8_t expected;
@@ -99,6 +89,7 @@ static void acceptor_free(void)
 		return;
 
 	l_timeout_remove(prov->timeout);
+	l_queue_destroy(prov->ob, l_free);
 
 	mesh_send_cancel(bec_filter, sizeof(bec_filter));
 	mesh_send_cancel(&pkt_filter, sizeof(pkt_filter));
@@ -126,6 +117,21 @@ static void acp_prov_close(void *user_data, uint8_t reason)
 	acceptor_free();
 }
 
+static void prov_send(struct mesh_prov_acceptor *prov, void *cmd, uint16_t len)
+{
+	struct deferred_cmd *defer;
+
+	if (prov->out_opcode == PROV_NONE) {
+		prov->out_opcode = *(uint8_t *) cmd;
+		prov->trans_tx(prov->trans_data, cmd, len);
+	} else {
+		defer = l_malloc(len + sizeof(struct deferred_cmd));
+		defer->len = len;
+		memcpy(defer->cmd, cmd, len);
+		l_queue_push_tail(prov->ob, defer);
+	}
+}
+
 static void prov_to(struct l_timeout *timeout, void *user_data)
 {
 	struct mesh_prov_acceptor *rx_prov = user_data;
@@ -140,7 +146,7 @@ static void prov_to(struct l_timeout *timeout, void *user_data)
 	if (prov->cmplt && prov->trans_tx) {
 		prov->cmplt(prov->caller_data, PROV_ERR_TIMEOUT, NULL);
 		prov->cmplt = NULL;
-		prov->trans_tx(prov->trans_data, fail_code, 2);
+		prov_send(prov, fail_code, 2);
 		prov->timeout = l_timeout_create(1, prov_to, prov, NULL);
 		return;
 	}
@@ -258,7 +264,7 @@ static void number_cb(void *user_data, int err, uint32_t number)
 	if (err) {
 		msg.opcode = PROV_FAILED;
 		msg.reason = PROV_ERR_UNEXPECTED_ERR;
-		prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+		prov_send(prov, &msg, sizeof(msg));
 		return;
 	}
 
@@ -267,7 +273,7 @@ static void number_cb(void *user_data, int err, uint32_t number)
 	l_put_be32(number, prov->rand_auth_workspace + 44);
 	prov->material |= MAT_RAND_AUTH;
 	msg.opcode = PROV_INP_CMPLT;
-	prov->trans_tx(prov->trans_data, &msg.opcode, 1);
+	prov_send(prov, &msg.opcode, 1);
 }
 
 static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
@@ -281,7 +287,7 @@ static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
 	if (err || !key || len != 16) {
 		msg.opcode = PROV_FAILED;
 		msg.reason = PROV_ERR_UNEXPECTED_ERR;
-		prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+		prov_send(prov, &msg, sizeof(msg));
 		return;
 	}
 
@@ -292,7 +298,7 @@ static void static_cb(void *user_data, int err, uint8_t *key, uint32_t len)
 
 	if (prov->conf_inputs.start.auth_action == PROV_ACTION_IN_ALPHA) {
 		msg.opcode = PROV_INP_CMPLT;
-		prov->trans_tx(prov->trans_data, &msg.opcode, 1);
+		prov_send(prov, &msg.opcode, 1);
 	}
 }
 
@@ -307,7 +313,7 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
 	if (err || !key || len != 32) {
 		msg.opcode = PROV_FAILED;
 		msg.reason = PROV_ERR_UNEXPECTED_ERR;
-		prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+		prov_send(prov, &msg, sizeof(msg));
 		return;
 	}
 
@@ -326,7 +332,7 @@ static void priv_key_cb(void *user_data, int err, uint8_t *key, uint32_t len)
 		if (!acp_credentials(prov)) {
 			msg.opcode = PROV_FAILED;
 			msg.reason = PROV_ERR_UNEXPECTED_ERR;
-			prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+			prov_send(prov, &msg, sizeof(msg));
 		}
 	}
 }
@@ -339,9 +345,8 @@ static void send_caps(struct mesh_prov_acceptor *prov)
 	memcpy(&msg.caps, &prov->conf_inputs.caps,
 			sizeof(prov->conf_inputs.caps));
 
-	prov->state = ACP_PROV_CAPS_SENT;
 	prov->expected = PROV_START;
-	prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+	prov_send(prov, &msg, sizeof(msg));
 }
 
 static void send_pub_key(struct mesh_prov_acceptor *prov)
@@ -350,7 +355,7 @@ static void send_pub_key(struct mesh_prov_acceptor *prov)
 
 	msg.opcode = PROV_PUB_KEY;
 	memcpy(msg.pub_key, prov->conf_inputs.dev_pub_key, sizeof(msg.pub_key));
-	prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+	prov_send(prov, &msg, sizeof(msg));
 }
 
 static bool send_conf(struct mesh_prov_acceptor *prov)
@@ -365,7 +370,7 @@ static bool send_conf(struct mesh_prov_acceptor *prov)
 	if (!memcmp(msg.conf, prov->confirm, sizeof(msg.conf)))
 		return false;
 
-	prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+	prov_send(prov, &msg, sizeof(msg));
 	return true;
 }
 
@@ -375,7 +380,7 @@ static void send_rand(struct mesh_prov_acceptor *prov)
 
 	msg.opcode = PROV_RANDOM;
 	memcpy(msg.rand, prov->rand_auth_workspace, sizeof(msg.rand));
-	prov->trans_tx(prov->trans_data, &msg, sizeof(msg));
+	prov_send(prov, &msg, sizeof(msg));
 }
 
 static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
@@ -614,8 +619,7 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
 
 		if (result) {
 			prov->rand_auth_workspace[0] = PROV_COMPLETE;
-			prov->trans_tx(prov->trans_data,
-					prov->rand_auth_workspace, 1);
+			prov_send(prov, prov->rand_auth_workspace, 1);
 			goto cleanup;
 		} else {
 			fail.reason = PROV_ERR_UNEXPECTED_ERR;
@@ -638,7 +642,7 @@ static void acp_prov_rx(void *user_data, const uint8_t *data, uint16_t len)
 
 failure:
 	fail.opcode = PROV_FAILED;
-	prov->trans_tx(prov->trans_data, &fail, sizeof(fail));
+	prov_send(prov, &fail, sizeof(fail));
 	if (prov->cmplt)
 		prov->cmplt(prov->caller_data, fail.reason, NULL);
 	prov->cmplt = NULL;
@@ -652,7 +656,23 @@ cleanup:
 
 static void acp_prov_ack(void *user_data, uint8_t msg_num)
 {
-	/* TODO: Handle PB-ADV Ack */
+	struct mesh_prov_acceptor *rx_prov = user_data;
+	struct deferred_cmd *deferred;
+
+	if (rx_prov != prov)
+		return;
+
+	if (prov->out_opcode == PROV_NONE)
+		return;
+
+	prov->out_opcode = PROV_NONE;
+
+	deferred = l_queue_pop_head(prov->ob);
+	if (!deferred)
+		return;
+
+	prov_send(prov, deferred->cmd, deferred->len);
+	l_free(deferred);
 }
 
 
@@ -680,7 +700,9 @@ bool acceptor_start(uint8_t num_ele, uint8_t uuid[16],
 	prov->to_secs = timeout;
 	prov->agent = agent;
 	prov->cmplt = complete_cb;
+	prov->ob = l_queue_new();
 	prov->previous = -1;
+	prov->out_opcode = PROV_NONE;
 	prov->caller_data = caller_data;
 
 	caps = mesh_agent_get_caps(agent);
diff --git a/mesh/provision.h b/mesh/provision.h
index 1a11b691b..1634c4d40 100644
--- a/mesh/provision.h
+++ b/mesh/provision.h
@@ -38,6 +38,7 @@ struct mesh_agent;
 #define PROV_DATA	0x07
 #define PROV_COMPLETE	0x08
 #define PROV_FAILED	0x09
+#define PROV_NONE	0xFF
 
 /* Spec defined Error Codes */
 #define PROV_ERR_SUCCESS		0x00
-- 
2.25.4

[PATCH BlueZ v3 6/6] mesh: Fix race condition memory leak

[Brian Gix]

This is a minor fix of a memory leak triggered on process exit if
proceess has been killed right after requesting an outbound
advertisement be sent.  It is harmless, but will cause an occasional
static analysis failure.
---
 mesh/mesh-io-generic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mesh/mesh-io-generic.c b/mesh/mesh-io-generic.c
index 4eb7f27ce..6c0b8f0fd 100644
--- a/mesh/mesh-io-generic.c
+++ b/mesh/mesh-io-generic.c
@@ -462,7 +462,9 @@ static bool dev_destroy(struct mesh_io *io)
 	bt_hci_unref(pvt->hci);
 	l_timeout_remove(pvt->tx_timeout);
 	l_queue_destroy(pvt->rx_regs, l_free);
+	l_queue_remove_if(pvt->tx_pkts, simple_match, pvt->tx);
 	l_queue_destroy(pvt->tx_pkts, l_free);
+	l_free(pvt->tx);
 	l_free(pvt);
 	io->pvt = NULL;
 
-- 
2.25.4