[PATCH v3] Bluetooth: virtio: Fix HCI device unregister on probe failure

[PATCH v3] Bluetooth: virtio: Fix HCI device unregister on probe failure

[Haoxiang Li]

virtbt_probe() registers the HCI device before opening the virtio
Bluetooth device. If virtbt_open_vdev() fails, the error path frees
the HCI device without unregistering it first.

The probe error paths also leak the virtio_bluetooth structure after it
has been allocated.

Rework the probe error handling into an unwind ladder so each failure
path releases the resources acquired earlier. Also close the virtio
device before unregistering the HCI device in virtbt_remove(), matching
the cleanup order used by the probe failure path.

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Fixes: dc65b4b0f90a ("Bluetooth: virtio_bt: fix device removal")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
---
Changes in v2:
 - Rework virtbt_probe() error paths into an unwind ladder.
 - Free vbt on probe failures.
 - Reset the virtio device and unregister the HCI device before freeing it
   when virtbt_open_vdev() fails.
 - Close the virtio device before unregistering the HCI device in remove().

   Thanks Dan for the suggestions. The blog is very helpful.
Changes in v3:
 - Remove virtio_reset_device() from the virtbt_open_vdev() failure path.
---
 drivers/bluetooth/virtio_bt.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..c063c2391c5c 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -311,12 +311,12 @@ static int virtbt_probe(struct virtio_device *vdev)
 
 	err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
 	if (err)
-		return err;
+		goto err_free_vbt;
 
 	hdev = hci_alloc_dev();
 	if (!hdev) {
 		err = -ENOMEM;
-		goto failed;
+		goto err_del_vqs;
 	}
 
 	vbt->hdev = hdev;
@@ -383,23 +383,27 @@ static int virtbt_probe(struct virtio_device *vdev)
 	if (virtio_has_feature(vdev, VIRTIO_BT_F_AOSP_EXT))
 		hci_set_aosp_capable(hdev);
 
-	if (hci_register_dev(hdev) < 0) {
-		hci_free_dev(hdev);
+	err = hci_register_dev(hdev);
+	if (err < 0) {
 		err = -EBUSY;
-		goto failed;
+		goto err_free_hdev;
 	}
 
 	virtio_device_ready(vdev);
 	err = virtbt_open_vdev(vbt);
 	if (err)
-		goto open_failed;
+		goto err_unregister_hdev;
 
 	return 0;
 
-open_failed:
+err_unregister_hdev:
+	hci_unregister_dev(hdev);
+err_free_hdev:
 	hci_free_dev(hdev);
-failed:
+err_del_vqs:
 	vdev->config->del_vqs(vdev);
+err_free_vbt:
+	kfree(vbt);
 	return err;
 }
 
@@ -408,10 +412,10 @@ static void virtbt_remove(struct virtio_device *vdev)
 	struct virtio_bluetooth *vbt = vdev->priv;
 	struct hci_dev *hdev = vbt->hdev;
 
-	hci_unregister_dev(hdev);
 	virtio_reset_device(vdev);
 	virtbt_close_vdev(vbt);
 
+	hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
 	vbt->hdev = NULL;
 
-- 
2.25.1

RE: [v3] Bluetooth: virtio: Fix HCI device unregister on probe failure

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1122868

---Test result---

Test Summary:
CheckPatch                    PASS      0.47 seconds
VerifyFixes                   PASS      0.07 seconds
VerifySignedoff               PASS      0.07 seconds
GitLint                       PASS      0.18 seconds
SubjectPrefix                 PASS      0.06 seconds
BuildKernel                   PASS      19.86 seconds
CheckAllWarning               PASS      22.13 seconds
CheckSparse                   PASS      22.34 seconds
BuildKernel32                 PASS      19.59 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      359.29 seconds
IncrementalBuild              PASS      19.28 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/406

---
Regards,
Linux Bluetooth

Re: [PATCH v3] Bluetooth: virtio: Fix HCI device unregister on probe failure

[Luiz Augusto von Dentz]

Hi Haoxiang,

On Tue, Jul 7, 2026 at 3:30 AM Haoxiang Li <haoxiang_li2024@163.com> wrote:
>
> virtbt_probe() registers the HCI device before opening the virtio
> Bluetooth device. If virtbt_open_vdev() fails, the error path frees
> the HCI device without unregistering it first.
>
> The probe error paths also leak the virtio_bluetooth structure after it
> has been allocated.
>
> Rework the probe error handling into an unwind ladder so each failure
> path releases the resources acquired earlier. Also close the virtio
> device before unregistering the HCI device in virtbt_remove(), matching
> the cleanup order used by the probe failure path.
>
> Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
> Fixes: dc65b4b0f90a ("Bluetooth: virtio_bt: fix device removal")
> Cc: stable@vger.kernel.org
> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
> ---
> Changes in v2:
>  - Rework virtbt_probe() error paths into an unwind ladder.
>  - Free vbt on probe failures.
>  - Reset the virtio device and unregister the HCI device before freeing it
>    when virtbt_open_vdev() fails.
>  - Close the virtio device before unregistering the HCI device in remove().
>
>    Thanks Dan for the suggestions. The blog is very helpful.
> Changes in v3:
>  - Remove virtio_reset_device() from the virtbt_open_vdev() failure path.
> ---
>  drivers/bluetooth/virtio_bt.c | 22 +++++++++++++---------
>  1 file changed, 13 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
> index 140ab55c9fc5..c063c2391c5c 100644
> --- a/drivers/bluetooth/virtio_bt.c
> +++ b/drivers/bluetooth/virtio_bt.c
> @@ -311,12 +311,12 @@ static int virtbt_probe(struct virtio_device *vdev)
>
>         err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
>         if (err)
> -               return err;
> +               goto err_free_vbt;
>
>         hdev = hci_alloc_dev();
>         if (!hdev) {
>                 err = -ENOMEM;
> -               goto failed;
> +               goto err_del_vqs;
>         }
>
>         vbt->hdev = hdev;
> @@ -383,23 +383,27 @@ static int virtbt_probe(struct virtio_device *vdev)
>         if (virtio_has_feature(vdev, VIRTIO_BT_F_AOSP_EXT))
>                 hci_set_aosp_capable(hdev);
>
> -       if (hci_register_dev(hdev) < 0) {
> -               hci_free_dev(hdev);
> +       err = hci_register_dev(hdev);
> +       if (err < 0) {
>                 err = -EBUSY;
> -               goto failed;
> +               goto err_free_hdev;
>         }
>
>         virtio_device_ready(vdev);
>         err = virtbt_open_vdev(vbt);
>         if (err)
> -               goto open_failed;
> +               goto err_unregister_hdev;
>
>         return 0;
>
> -open_failed:
> +err_unregister_hdev:
> +       hci_unregister_dev(hdev);
> +err_free_hdev:
>         hci_free_dev(hdev);
> -failed:
> +err_del_vqs:
>         vdev->config->del_vqs(vdev);
> +err_free_vbt:
> +       kfree(vbt);

Sashiko flagged a new problem regarding the code above:

https://sashiko.dev/#/patchset/20260707072955.3093138-1-haoxiang_li2024%40163.com

>         return err;
>  }
>
> @@ -408,10 +412,10 @@ static void virtbt_remove(struct virtio_device *vdev)
>         struct virtio_bluetooth *vbt = vdev->priv;
>         struct hci_dev *hdev = vbt->hdev;
>
> -       hci_unregister_dev(hdev);
>         virtio_reset_device(vdev);
>         virtbt_close_vdev(vbt);
>
> +       hci_unregister_dev(hdev);
>         hci_free_dev(hdev);
>         vbt->hdev = NULL;
>
> --
> 2.25.1
>


-- 
Luiz Augusto von Dentz