[PATCH v3 RESEND 1/5] Bluetooth: btusb: fix use-after-free on registration failure

[PATCH v3 RESEND 1/5] Bluetooth: btusb: fix use-after-free on registration failure

[Johan Hovold]

Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.

Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver")
Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
Cc: stable@vger.kernel.org	# 2.6.27
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/bluetooth/btusb.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 830fefb342c6..c8015cee240f 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4407,7 +4407,7 @@ static int btusb_probe(struct usb_interface *intf,
 
 	err = hci_register_dev(hdev);
 	if (err < 0)
-		goto out_free_dev;
+		goto err_release_siblings;
 
 	usb_set_intfdata(intf, data);
 
@@ -4416,6 +4416,15 @@ static int btusb_probe(struct usb_interface *intf,
 
 	return 0;
 
+err_release_siblings:
+	if (data->diag) {
+		usb_set_intfdata(data->diag, NULL);
+		usb_driver_release_interface(&btusb_driver, data->diag);
+	}
+	if (data->isoc) {
+		usb_set_intfdata(data->isoc, NULL);
+		usb_driver_release_interface(&btusb_driver, data->isoc);
+	}
 out_free_dev:
 	if (data->reset_gpio)
 		gpiod_put(data->reset_gpio);
-- 
2.53.0

[PATCH v3 RESEND 2/5] Bluetooth: btusb: fix use-after-free on marvell probe failure

[Johan Hovold]

Make sure to stop any TX URBs submitted during Marvell OOB wakeup
configuration on later probe failures to avoid use-after-free in the
completion callback.

This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.

Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the pins for oob wakeup")
Cc: stable@vger.kernel.org	# 4.11
Cc: Rajat Jain <rajatja@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/bluetooth/btusb.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c8015cee240f..d0a83a1ffdf2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4218,7 +4218,7 @@ static int btusb_probe(struct usb_interface *intf,
 	if (id->driver_info & BTUSB_INTEL_COMBINED) {
 		err = btintel_configure_setup(hdev, btusb_driver.name);
 		if (err)
-			goto out_free_dev;
+			goto err_kill_tx_urbs;
 
 		/* Transport specific configuration */
 		hdev->send = btusb_send_frame_intel;
@@ -4381,7 +4381,7 @@ static int btusb_probe(struct usb_interface *intf,
 		err = usb_set_interface(data->udev, 0, 0);
 		if (err < 0) {
 			BT_ERR("failed to set interface 0, alt 0 %d", err);
-			goto out_free_dev;
+			goto err_kill_tx_urbs;
 		}
 	}
 
@@ -4389,7 +4389,7 @@ static int btusb_probe(struct usb_interface *intf,
 		err = usb_driver_claim_interface(&btusb_driver,
 						 data->isoc, data);
 		if (err < 0)
-			goto out_free_dev;
+			goto err_kill_tx_urbs;
 	}
 
 	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
@@ -4425,6 +4425,8 @@ static int btusb_probe(struct usb_interface *intf,
 		usb_set_intfdata(data->isoc, NULL);
 		usb_driver_release_interface(&btusb_driver, data->isoc);
 	}
+err_kill_tx_urbs:
+	usb_kill_anchored_urbs(&data->tx_anchor);
 out_free_dev:
 	if (data->reset_gpio)
 		gpiod_put(data->reset_gpio);
-- 
2.53.0

[PATCH v3 RESEND 3/5] Bluetooth: btusb: fix wakeup source leak on probe failure

[Johan Hovold]

Make sure to disable wakeup on probe failure to avoid leaking the wakeup
source.

Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support")
Cc: stable@vger.kernel.org	# 4.11
Cc: Rajat Jain <rajatja@google.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
---
 drivers/bluetooth/btusb.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index d0a83a1ffdf2..622df2fff497 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4181,7 +4181,7 @@ static int btusb_probe(struct usb_interface *intf,
 	if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
 		err = marvell_config_oob_wake(hdev);
 		if (err)
-			goto out_free_dev;
+			goto err_disable_wakeup;
 	}
 #endif
 	if (id->driver_info & BTUSB_CW6622)
@@ -4427,6 +4427,9 @@ static int btusb_probe(struct usb_interface *intf,
 	}
 err_kill_tx_urbs:
 	usb_kill_anchored_urbs(&data->tx_anchor);
+err_disable_wakeup:
+	if (data->oob_wake_irq)
+		device_init_wakeup(&data->udev->dev, false);
 out_free_dev:
 	if (data->reset_gpio)
 		gpiod_put(data->reset_gpio);
-- 
2.53.0

Re: [PATCH v3 RESEND 3/5] Bluetooth: btusb: fix wakeup source leak on probe failure

[Luiz Augusto von Dentz]

Hi Johan,

On Wed, Jun 3, 2026 at 10:37 AM Johan Hovold <johan@kernel.org> wrote:
>
> Make sure to disable wakeup on probe failure to avoid leaking the wakeup
> source.
>
> Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support")
> Cc: stable@vger.kernel.org      # 4.11
> Cc: Rajat Jain <rajatja@google.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>
> ---
>  drivers/bluetooth/btusb.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> index d0a83a1ffdf2..622df2fff497 100644
> --- a/drivers/bluetooth/btusb.c
> +++ b/drivers/bluetooth/btusb.c
> @@ -4181,7 +4181,7 @@ static int btusb_probe(struct usb_interface *intf,
>         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
>                 err = marvell_config_oob_wake(hdev);
>                 if (err)
> -                       goto out_free_dev;
> +                       goto err_disable_wakeup;
>         }
>  #endif
>         if (id->driver_info & BTUSB_CW6622)
> @@ -4427,6 +4427,9 @@ static int btusb_probe(struct usb_interface *intf,
>         }
>  err_kill_tx_urbs:
>         usb_kill_anchored_urbs(&data->tx_anchor);
> +err_disable_wakeup:
> +       if (data->oob_wake_irq)
> +               device_init_wakeup(&data->udev->dev, false);
>  out_free_dev:
>         if (data->reset_gpio)
>                 gpiod_put(data->reset_gpio);
> --
> 2.53.0

This seem to trigger a compilation problem according to sashiko:

The goto statement targeting err_disable_wakeup is wrapped in an ifdef
CONFIG_PM block earlier in the function, but this label is defined
unconditionally here.
[]https://sashiko.dev/#/patchset/20260603143643.2514595-1-johan%40kernel.org

-- 
Luiz Augusto von Dentz

Re: [PATCH v3 RESEND 3/5] Bluetooth: btusb: fix wakeup source leak on probe failure

[Johan Hovold]

On Wed, Jun 03, 2026 at 02:06:08PM -0400, Luiz Augusto von Dentz wrote:
> On Wed, Jun 3, 2026 at 10:37 AM Johan Hovold <johan@kernel.org> wrote:

> > @@ -4181,7 +4181,7 @@ static int btusb_probe(struct usb_interface *intf,
> >         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
> >                 err = marvell_config_oob_wake(hdev);
> >                 if (err)
> > -                       goto out_free_dev;
> > +                       goto err_disable_wakeup;
> >         }
> >  #endif
> >         if (id->driver_info & BTUSB_CW6622)
> > @@ -4427,6 +4427,9 @@ static int btusb_probe(struct usb_interface *intf,
> >         }
> >  err_kill_tx_urbs:
> >         usb_kill_anchored_urbs(&data->tx_anchor);
> > +err_disable_wakeup:
> > +       if (data->oob_wake_irq)
> > +               device_init_wakeup(&data->udev->dev, false);
> >  out_free_dev:
> >         if (data->reset_gpio)
> >                 gpiod_put(data->reset_gpio);
> > --
> > 2.53.0
> 
> This seem to trigger a compilation problem according to sashiko:
> 
> The goto statement targeting err_disable_wakeup is wrapped in an ifdef
> CONFIG_PM block earlier in the function, but this label is defined
> unconditionally here.
> []https://sashiko.dev/#/patchset/20260603143643.2514595-1-johan%40kernel.org

Indeed. Sorry about that. I just sent a v4 addressing this here:

	https://lore.kernel.org/lkml/20260604063740.2595260-1-johan@kernel.org/

Johan