[PATCH] Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

[PATCH] Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@kylinos.cn>

In btintel_pcie_probe(), when btintel_pcie_alloc() succeeds but a
later step (btintel_pcie_enable_bt, btintel_pcie_start_rx, or
btintel_pcie_setup_hdev) fails, the DMA buffers and descriptors
allocated by btintel_pcie_alloc() are not freed. The exit_error
path only resets the device and destroys workqueues, causing a
DMA memory leak.

Fix this by introducing an exit_error_free label that calls
btintel_pcie_free(data) to release all DMA buffers and the DMA
pool before proceeding to the common exit_error path. Error paths
after successful allocation jump to exit_error_free, while the
allocation failure itself (which is already cleaned up internally
by btintel_pcie_alloc) jumps directly to exit_error.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
---
 drivers/bluetooth/btintel_pcie.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 9e39327dc1fe..b672ce376e9d 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2896,7 +2896,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	err = btintel_pcie_enable_bt(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	/* CNV information (CNVi and CNVr) is in CSR */
 	data->cnvi = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_HW_REV_REG);
@@ -2905,16 +2905,20 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	err = btintel_pcie_start_rx(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	err = btintel_pcie_setup_hdev(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	bt_dev_dbg(data->hdev, "cnvi: 0x%8.8x cnvr: 0x%8.8x", data->cnvi,
 		   data->cnvr);
 	return 0;
 
+exit_error_free:
+	/* Free DMA buffers and descriptors allocated in btintel_pcie_alloc() */
+	btintel_pcie_free(data);
+
 exit_error:
 	/* reset device before exit */
 	btintel_pcie_reset_bt(data);
-- 
2.25.1

RE: Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1126490

---Test result---

Test Summary:
CheckPatch                    PASS      1.41 seconds
VerifyFixes                   PASS      0.14 seconds
VerifySignedoff               PASS      0.14 seconds
GitLint                       PASS      0.34 seconds
SubjectPrefix                 PASS      0.13 seconds
BuildKernel                   PASS      27.21 seconds
CheckAllWarning               PASS      30.04 seconds
CheckSparse                   PASS      28.04 seconds
BuildKernel32                 PASS      25.64 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      495.76 seconds
IncrementalBuild              PASS      24.87 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/429

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

[Luiz Augusto von Dentz]

Hi Zhao,

On Mon, Jul 13, 2026 at 6:38 AM Zhao Dongdong <winter91@foxmail.com> wrote:
>
> From: Zhao Dongdong <zhaodongdong@kylinos.cn>
>
> In btintel_pcie_probe(), when btintel_pcie_alloc() succeeds but a
> later step (btintel_pcie_enable_bt, btintel_pcie_start_rx, or
> btintel_pcie_setup_hdev) fails, the DMA buffers and descriptors
> allocated by btintel_pcie_alloc() are not freed. The exit_error
> path only resets the device and destroys workqueues, causing a
> DMA memory leak.
>
> Fix this by introducing an exit_error_free label that calls
> btintel_pcie_free(data) to release all DMA buffers and the DMA
> pool before proceeding to the common exit_error path. Error paths
> after successful allocation jump to exit_error_free, while the
> allocation failure itself (which is already cleaned up internally
> by btintel_pcie_alloc) jumps directly to exit_error.
>
> Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
> Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
> ---
>  drivers/bluetooth/btintel_pcie.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 9e39327dc1fe..b672ce376e9d 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -2896,7 +2896,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
>
>         err = btintel_pcie_enable_bt(data);
>         if (err)
> -               goto exit_error;
> +               goto exit_error_free;
>
>         /* CNV information (CNVi and CNVr) is in CSR */
>         data->cnvi = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_HW_REV_REG);
> @@ -2905,16 +2905,20 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
>
>         err = btintel_pcie_start_rx(data);
>         if (err)
> -               goto exit_error;
> +               goto exit_error_free;
>
>         err = btintel_pcie_setup_hdev(data);
>         if (err)
> -               goto exit_error;
> +               goto exit_error_free;
>
>         bt_dev_dbg(data->hdev, "cnvi: 0x%8.8x cnvr: 0x%8.8x", data->cnvi,
>                    data->cnvr);
>         return 0;
>
> +exit_error_free:
> +       /* Free DMA buffers and descriptors allocated in btintel_pcie_alloc() */
> +       btintel_pcie_free(data);
> +
>  exit_error:
>         /* reset device before exit */
>         btintel_pcie_reset_bt(data);
> --
> 2.25.1

Sashiko seem to have found a problem with this change:

https://sashiko.dev/#/patchset/tencent_44ED865C14DA3D3823CA85AE1DF2CEBC1805%40qq.com

-- 
Luiz Augusto von Dentz