[PATCH 0/2] Bluetooth: virtio_bt: harden probe error paths

[PATCH 0/2] Bluetooth: virtio_bt: harden probe error paths

[Yi Cong]

From: Yi Cong <yicong@kylinos.cn>

This small series hardens the two error paths in virtbt_probe() that
currently leak or leave dangling state behind:

  1/2 - if virtio_find_vqs() fails, the allocated 'vbt' and the
        'vdev->priv' pointer that already references it are leaked.
  2/2 - if virtbt_open_vdev() fails after hci_register_dev() has
        succeeded, the hdev is freed without unregistering, leaving a
        dangling entry in the global HCI device list (UAF).

  Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")

Yi Cong (2):
  Bluetooth: virtio_bt: fix leak of vbt on virtio_find_vqs failure
  Bluetooth: virtio_bt: unregister hdev before freeing on open failure

 drivers/bluetooth/virtio_bt.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

-- 
2.25.1

[PATCH 1/2] Bluetooth: virtio_bt: fix leak of vbt on virtio_find_vqs failure

[Yi Cong]

From: Yi Cong <yicong@kylinos.cn>

If virtio_find_vqs() fails, the function returns without freeing the
allocated 'vbt' or clearing 'vdev->priv'.  Add a 'free_priv' label to
release them, and let 'failed' fall through to it.

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Cong <yicong@kylinos.cn>
---
 drivers/bluetooth/virtio_bt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index c20d54088c8c4..b674fe0c2779e 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -315,7 +315,7 @@ static int virtbt_probe(struct virtio_device *vdev)
 
 	err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
 	if (err)
-		return err;
+		goto free_priv;
 
 	hdev = hci_alloc_dev();
 	if (!hdev) {
@@ -404,6 +404,9 @@ static int virtbt_probe(struct virtio_device *vdev)
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);
+free_priv:
+	vdev->priv = NULL;
+	kfree(vbt);
 	return err;
 }
 
-- 
2.25.1

[PATCH 2/2] Bluetooth: virtio_bt: unregister hdev before freeing on open failure

[Yi Cong]

From: Yi Cong <yicong@kylinos.cn>

When virtbt_open_vdev() fails after hci_register_dev() has succeeded,
the 'open_failed' path frees the hdev without unregistering it first,
leaving a dangling entry in the global HCI device list.

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Cong <yicong@kylinos.cn>
---
 drivers/bluetooth/virtio_bt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index b674fe0c2779e..7c9c3f0085dc0 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -401,6 +401,7 @@ static int virtbt_probe(struct virtio_device *vdev)
 	return 0;
 
 open_failed:
+	hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);
-- 
2.25.1

RE: Bluetooth: virtio_bt: harden probe error paths

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1143771

---Test result---

Test Summary:
CheckPatch                    PASS      1.03 seconds
VerifyFixes                   PASS      0.06 seconds
VerifySignedoff               PASS      0.06 seconds
GitLint                       PASS      0.39 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      27.54 seconds
CheckAllWarning               PASS      30.76 seconds
CheckSparse                   PASS      28.75 seconds
BuildKernel32                 PASS      26.32 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      507.05 seconds
IncrementalBuild              PASS      27.24 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/568

---
Regards,
Linux Bluetooth