[PATCH] Bluetooth: virtio_bt: fix virtbt_probe error handling

[PATCH] Bluetooth: virtio_bt: fix virtbt_probe error handling

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@kylinos.cn>

The error handling in virtbt_probe() has two issues:

1. Memory leak: vbt is allocated via kzalloc_obj() but not freed on
   the virtio_find_vqs() failure path nor the generic failed path.

2. Clean-up order on open failure: virtbt_open_vdev() failing after
   hci_register_dev() leaves the device registered and queues
   dangling. Only hci_free_dev() is called, skipping unregister,
   reset and buffer cleanup.

Fix 1: add find_vqs_failed label (after del_vqs) so that VQS
failures skip queue teardown while still freeing vbt.

Fix 2: re-open the open_failed path to mirror the remove sequence
in reverse order: virtbt_close_vdev() to drop queued buffers,
virtio_reset_device() to quiesce the device, hci_unregister_dev()
to deregister from the BT core, then hci_free_dev().

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
---
 drivers/bluetooth/virtio_bt.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..cca7e1281740 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -311,7 +311,7 @@ static int virtbt_probe(struct virtio_device *vdev)

 	err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
 	if (err)
-		return err;
+		goto find_vqs_failed;

 	hdev = hci_alloc_dev();
 	if (!hdev) {
@@ -397,9 +397,15 @@ static int virtbt_probe(struct virtio_device *vdev)
 	return 0;

 open_failed:
+	virtbt_close_vdev(vbt);
+	virtio_reset_device(vdev);
+	hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);
+find_vqs_failed:
+	vdev->priv = NULL;
+	kfree(vbt);
 	return err;
 }

--
2.43.0

RE: Bluetooth: virtio_bt: fix virtbt_probe error handling

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1127014

---Test result---

Test Summary:
CheckPatch                    PASS      0.62 seconds
VerifyFixes                   PASS      0.09 seconds
VerifySignedoff               PASS      0.09 seconds
GitLint                       PASS      0.24 seconds
SubjectPrefix                 PASS      0.08 seconds
BuildKernel                   PASS      26.91 seconds
CheckAllWarning               PASS      29.40 seconds
CheckSparse                   PASS      27.84 seconds
BuildKernel32                 PASS      26.04 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      502.07 seconds
IncrementalBuild              PASS      25.70 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/433

---
Regards,
Linux Bluetooth