[PATCH] Bluetooth: btintel_pcie: fix memory leak in btintel_pcie_probe()

[PATCH] Bluetooth: btintel_pcie: fix memory leak in btintel_pcie_probe()

[Abdun Nihaal]

The memory allocated for data->workqueue is not free in some of the
error paths. Fix that by adding the corresponding free function.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Cc: stable@vger.kernel.org
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
---
Compile tested only. Issue found using static analysis.

 drivers/bluetooth/btintel_pcie.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 7a87549f587d..870939d8450b 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2988,6 +2988,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 	btintel_pcie_reset_bt(data);
 
 	destroy_workqueue(data->dump_workqueue);
+	destroy_workqueue(data->workqueue);
 
 	pci_clear_master(pdev);
 
-- 
2.43.0

Re: [PATCH] Bluetooth: btintel_pcie: fix memory leak in btintel_pcie_probe()

[Paul Menzel]

Dear Abdun,


Welcome, and thank you for your patch.

Am 10.07.26 um 08:03 schrieb Abdun Nihaal:
> The memory allocated for data->workqueue is not free in some of the

free*d*

> error paths. Fix that by adding the corresponding free function.
> 
> Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
> Cc: stable@vger.kernel.org
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
> ---
> Compile tested only. Issue found using static analysis.

Maybe add that to the commit message, and the mention the tool you used.

> 
>   drivers/bluetooth/btintel_pcie.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 7a87549f587d..870939d8450b 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -2988,6 +2988,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
>   	btintel_pcie_reset_bt(data);
>   
>   	destroy_workqueue(data->dump_workqueue);
> +	destroy_workqueue(data->workqueue);

gemini/gemini-3.1-pro-preview comments [1]:

> Is there a use-after-free race condition introduced here? 
> If the workqueue is destroyed while the devm-managed IRQ handler is still
> active, could an inbound device interrupt arrive before devres tears down the
> handlers? This would route to the active handler and execute queue_work()
> against the destroyed workqueue memory.


>   
>   	pci_clear_master(pdev);


Kind regards,

Paul


[1]: 
https://sashiko.dev/#/patchset/20260710060334.136987-1-nihaal%40cse.iitm.ac.in

Re: [PATCH] Bluetooth: btintel_pcie: fix memory leak in btintel_pcie_probe()

[Abdun Nihaal]

Thanks for your comments. I'll update the commit message and also fix
the issue pointed by Sashiko, and send a v2 patch.

Regards,
Nihaal

RE: Bluetooth: btintel_pcie: fix memory leak in btintel_pcie_probe()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1125145

---Test result---

Test Summary:
CheckPatch                    PASS      0.60 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.25 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      27.95 seconds
CheckAllWarning               PASS      30.08 seconds
CheckSparse                   PASS      29.87 seconds
BuildKernel32                 PASS      27.09 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      510.50 seconds
IncrementalBuild              PASS      25.66 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/419

---
Regards,
Linux Bluetooth