[PATCH] Bluetooth: virtio_bt: fix memory leak in virtbt_probe

[PATCH] Bluetooth: virtio_bt: fix memory leak in virtbt_probe

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@kylinos.cn>

In virtbt_probe(), the vbt structure is allocated via kzalloc_obj()
but not freed when virtio_find_vqs() fails. Additionally, the
open_failed and failed error labels do not free vbt, causing a
memory leak on any error path after vbt allocation.

Fix the leak by adding a dedicated err_find_vqs label after del_vqs
in the failed path, so that find_vqs failures skip del_vqs (since
vqs were never established) while still freeing vbt. The existing
failed and open_failed labels also gain vbt cleanup.

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
---
 drivers/bluetooth/virtio_bt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..61ab3863bb0f 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -311,7 +311,7 @@ static int virtbt_probe(struct virtio_device *vdev)
 
 	err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
 	if (err)
-		return err;
+		goto find_vqs_failed;
 
 	hdev = hci_alloc_dev();
 	if (!hdev) {
@@ -400,6 +400,9 @@ static int virtbt_probe(struct virtio_device *vdev)
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);
+find_vqs_failed:
+	vdev->priv = NULL;
+	kfree(vbt);
 	return err;
 }
 
-- 
2.25.1

RE: Bluetooth: virtio_bt: fix memory leak in virtbt_probe

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1124217

---Test result---

Test Summary:
CheckPatch                    PASS      0.43 seconds
VerifyFixes                   PASS      0.08 seconds
VerifySignedoff               PASS      0.08 seconds
GitLint                       PASS      0.19 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      15.57 seconds
CheckAllWarning               PASS      17.02 seconds
CheckSparse                   PASS      16.10 seconds
BuildKernel32                 PASS      14.94 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      277.51 seconds
IncrementalBuild              PASS      15.00 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/412

---
Regards,
Linux Bluetooth