3 files changed, 16 insertions, 0 deletions

diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 0e7ee892d7ab..89eda2ef2380 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -244,6 +244,7 @@ struct hci_dev {
         struct sk_buff_head     raw_q;
         struct sk_buff_head     cmd_q;
 
+        struct sk_buff          *recv_evt;
         struct sk_buff          *sent_cmd;
         struct sk_buff          *reassembly[NUM_REASSEMBLY];
 
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index a199d631e31c..7c323bd112ff 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1136,6 +1136,9 @@ static int hci_dev_do_close(struct hci_dev *hdev)
                 hdev->sent_cmd = NULL;
         }
 
+        kfree_skb(hdev->recv_evt);
+        hdev->recv_evt = NULL;
+
         /* After this point our queues are empty
          * and no tasks are scheduled. */
         hdev->close(hdev);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 7e7fbca59439..ed0efb7255b0 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3699,6 +3699,18 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
         struct hci_event_hdr *hdr = (void *) skb->data;
         __u8 event = hdr->evt;
 
+        hci_dev_lock(hdev);
+
+        /* Received events are (currently) only needed when a request is
+         * ongoing so avoid unnecessary memory allocation.
+         */
+        if (hdev->req_status == HCI_REQ_PEND) {
+                kfree_skb(hdev->recv_evt);
+                hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
+        }
+
+        hci_dev_unlock(hdev);
+
         skb_pull(skb, HCI_EVENT_HDR_SIZE);
 
         switch (event) {