From nobody Sun Jun 14 09:53:31 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DBB4A3921DF; Thu, 2 Apr 2026 09:27:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775122053; cv=none; b=RdquU8O9QSEM1tAr0WKGABEwXJ0lE0XDPp1FQUwFnJahxwvhKkOUVs3ZLkNrvJcTwnz02+2o4c22yrC8fdvQ4dq2IzhAZT8bc8VD0vhr+CmFSq1p2ems2TVCUFgz1gsCeUYQ8ZA2LSBmNzS4MuekZ/z0y5tc9QImvG2x7ELVrOc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775122053; c=relaxed/simple; bh=hZXVRO7WK1sAdCW6Mwg67FMXjt+GSDlkVsjEmn3eu4s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nFNrzZVYPEUqQo39JN+FKPSuQUggaZZcim4ZNVI+zYwdsQb7zgWlNWJ4LMiFA0k039qzS0RGMKK560WAA2/y/0yX3CQUiltRhHl8S670EtcJaJtiw71DatAiIUAdojhSKosQE3znW4p3lPWjxrft8SX5NHrH63FV4QIVdM8tHAE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Sv9Zhps6; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Sv9Zhps6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F667C2BC9E; Thu, 2 Apr 2026 09:27:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775122052; bh=hZXVRO7WK1sAdCW6Mwg67FMXjt+GSDlkVsjEmn3eu4s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Sv9Zhps61b7Z+3qpaxmqBbuk14oMt6DuqHqcClBLwpuDsP3QpoECW9o5mHU29mOET ZNSug1JNKBjZMGV7qrFTGfiaDFuovCs2ZHl/r8THznOdLYwHfCow4JVjcCwyB/BSSt KT/iT7wNW4QI3l7rFVWuYZVBzVcxcNYE7TGWploDaxQDHzw+4uJjqbsT3q8141haSM RSWDcC/e9d4qaY9kL+QurrfuRHl0eiWoL12ATEuP2zu/KyPD+uiWYNNZKpJH/UiAOd hVe4MA7Q1J0jvJoXdwZ8T1M2Js6sWk70gTAJFiRAUBA2junjv1oPSb3ZfaFO22GUQ8 rUV1ZAHG/nKbQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8EKo-00000009qUn-0FIA; Thu, 02 Apr 2026 11:27:30 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Rajat Jain Subject: [PATCH v2 1/3] Bluetooth: btusb: fix wakeup source leak on probe failure Date: Thu, 2 Apr 2026 11:27:02 +0200 Message-ID: <20260402092704.2346710-2-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402092704.2346710-1-johan@kernel.org> References: <20260402092704.2346710-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to disable wakeup on probe failure to avoid leaking the wakeup source. Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: stable@vger.kernel.org # 4.11 Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 21e85c212506..9e4390ba82ba 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4146,7 +4146,7 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { err =3D marvell_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_disable_wakeup; } #endif if (id->driver_info & BTUSB_CW6622) @@ -4183,7 +4183,7 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_INTEL_COMBINED) { err =3D btintel_configure_setup(hdev, btusb_driver.name); if (err) - goto out_free_dev; + goto err_disable_wakeup; =20 /* Transport specific configuration */ hdev->send =3D btusb_send_frame_intel; @@ -4346,7 +4346,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_set_interface(data->udev, 0, 0); if (err < 0) { BT_ERR("failed to set interface 0, alt 0 %d", err); - goto out_free_dev; + goto err_disable_wakeup; } } =20 @@ -4354,7 +4354,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_driver_claim_interface(&btusb_driver, data->isoc, data); if (err < 0) - goto out_free_dev; + goto err_disable_wakeup; } =20 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) { @@ -4372,7 +4372,7 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D hci_register_dev(hdev); if (err < 0) - goto out_free_dev; + goto err_disable_wakeup; =20 usb_set_intfdata(intf, data); =20 @@ -4381,6 +4381,9 @@ static int btusb_probe(struct usb_interface *intf, =20 return 0; =20 +err_disable_wakeup: + if (data->oob_wake_irq) + device_init_wakeup(&data->udev->dev, false); out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.52.0 From nobody Sun Jun 14 09:53:31 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D902E388E76; Thu, 2 Apr 2026 09:27:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775122053; cv=none; b=M3YG8n373OJN/+DculiaKVl2/mWepYpMqNRE4I0TyEGQdWnnf2314xd0q5oKTIv2I4pYv3nVWPokeIFuiz+Ouw/obonnpqcpodh9S4VabhroVI1W8GJjPQTjQeW4wWhTZPVzOTFdGxtxGPZOlfOljs+t79ZWfFZeipc5pxV4Kwk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775122053; c=relaxed/simple; bh=zq0jQHD/gI2al+Mu/lC9PtgXBd21pPA9ncMSg1zf5HQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=gX2Xp70oXzo+fv+Izoi7A160kmI5A7Ypa+3sAHJQGiet7ZOtQMD9/DSK/3ZUUUFGKvbfIT3lA1iCID1m3RFuVnYWPv0ZOxyzCV3ACEwHvMcbZ2yV8Np1cnrcalQQYJd8+r7VSBE7DDpbPqwP07yngZbO3+lxrC91VMGk/zI6oqU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HCCsQ/2G; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HCCsQ/2G" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63A67C116C6; Thu, 2 Apr 2026 09:27:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775122052; bh=zq0jQHD/gI2al+Mu/lC9PtgXBd21pPA9ncMSg1zf5HQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HCCsQ/2GAK3RmWjytZGlgLVgNZnFQAL6Q2cXg3zo0tYho3lJZme8Ubv6lXrHvUvL5 J6guPkjhO0BZfF3Eo6ZiXYhHAxpsNE6L9b+MxZnUdCBinsmyyiDQYUaaK7DEB+Nkmv YUQbvvl9rvvVCOPSgyO3/HEpxdJpT8IlL6Hy7SXeuxLccZ5RK7eClZ+HzSKT0iKYFn xQaWz86QR6xYKVnhYopVCB2NaSVQ42hvLnzI1zivXiGXyxWwO0gvTTFDJ05ss2a4/7 FkMWc49zHxsTdL3XkLH3vVOUdeF4wsuVWAe4cwfG5EJn6R82mGMQHWRKydnQ2sg5uM bhpkQ/8T6IIFQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8EKo-00000009qUp-0Hnq; Thu, 02 Apr 2026 11:27:30 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Rajat Jain Subject: [PATCH v2 2/3] Bluetooth: btusb: fix wakeup irq devres lifetime Date: Thu, 2 Apr 2026 11:27:03 +0200 Message-ID: <20260402092704.2346710-3-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402092704.2346710-1-johan@kernel.org> References: <20260402092704.2346710-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The OOB wakeup irq is device managed but its lifetime is incorrectly tied to the child HCI device rather than the USB interface to which the driver is bound. This should not cause any trouble currently as the interrupt will be disabled when the HCI device is deregistered on disconnect (but this was not always the case, see [1]), and there should be no further references if probe fails before registering it. But it is still technically wrong as the reference counted HCI device could in theory remain after a probe failure. Explicitly free the interrupt on disconnect so that it is guaranteed to be disabled before freeing the (non-managed) driver data (including if disconnected while suspended). [1] 699fb50d9903 ("drivers: base: Free devm resources when unregistering a device") Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 9e4390ba82ba..0001477463a3 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3784,8 +3784,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev) } =20 irq_set_status_flags(irq, IRQ_NOAUTOEN); - ret =3D devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, - 0, "OOB Wake-on-BT", data); + ret =3D request_irq(irq, btusb_oob_wake_handler, 0, "OOB Wake-on-BT", dat= a); if (ret) { bt_dev_err(hdev, "%s: IRQ request failed", __func__); return ret; @@ -3794,12 +3793,18 @@ static int btusb_config_oob_wake(struct hci_dev *hd= ev) ret =3D device_init_wakeup(dev, true); if (ret) { bt_dev_err(hdev, "%s: failed to init_wakeup", __func__); - return ret; + goto err_free_irq; } =20 data->oob_wake_irq =3D irq; bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); + return 0; + +err_free_irq: + free_irq(irq, data); + + return ret; } #endif =20 @@ -4382,8 +4387,10 @@ static int btusb_probe(struct usb_interface *intf, return 0; =20 err_disable_wakeup: - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); @@ -4416,8 +4423,11 @@ static void btusb_disconnect(struct usb_interface *i= ntf) =20 hci_unregister_dev(hdev); =20 - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } + if (data->reset_gpio) gpiod_put(data->reset_gpio); =20 --=20 2.52.0 From nobody Sun Jun 14 09:53:31 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EDF203939C8; Thu, 2 Apr 2026 09:27:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775122053; cv=none; b=p26oYr//bjX5fU0rGh98VdV/40yazKkqp++d54qRW2Ov0agrAga9xRxnGVTWtPI/AOErUqitlGpLnaxIkLsBFNj85r7AVkj2eoxbx6xkmU4QnkZ4/BHpFpg/w8wUsfU63rm1tIeQ8kpLARgvkn52YbFabjb1Vmd/taNcilMiCUQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775122053; c=relaxed/simple; bh=IXIEWBIWCqof18A43cfnb86WqaIOtazyVtqjLxeWcAI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bzuhrcLhzSrTEUimSNeo43ZvDHycdU8mTwgRPeLpb0uC3wHDBTAvPlWWXQ62ZSKZZ7RNuutWNMwWNExLlZHF2yT9LkKOd4gtXrITWUmz7lzZeKUyaDMAuAMptjYj47p2HKdy7Lf/optlgEYGwtH9OasH+5C5cf5GeNfnY9AAOIE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Z8I0O2Uq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Z8I0O2Uq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D4D7C19423; Thu, 2 Apr 2026 09:27:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775122052; bh=IXIEWBIWCqof18A43cfnb86WqaIOtazyVtqjLxeWcAI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z8I0O2UqeRk2dxXGeIYM9cwNg4XDVKMi/flbHSI/ehv+wuGs/G380ccKCefHnS5h2 bBLBPsnh/qRTJ8wkVc+IA/t+UrqoaPzSzCm+Fj58j0/2Ykeq+2U4/PDlSACZ/9CvjB GJ4ltM82anqQOW0D43hQN1I6dzaux7QWAarqGvwvRBZ8Y4O/LL2Pv5y9sHX5QHtW8n H96xG/vGzjQhwv+pa7BBPMWJjx+crzsv1dann4Ae0fa3vhgxEpxdbgZjaVQofmeNji SVU1LrZZJ63Yf73ml6TQ5yqxc/r9jJXisy8FCSFZlcbvrw5+P50Bp2Hx76QXAID4lY BmBg5+ANhGZZw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8EKo-00000009qUr-0KFs; Thu, 02 Apr 2026 11:27:30 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v2 3/3] Bluetooth: btusb: clean up probe error handling Date: Thu, 2 Apr 2026 11:27:04 +0200 Message-ID: <20260402092704.2346710-4-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402092704.2346710-1-johan@kernel.org> References: <20260402092704.2346710-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clean up probe error handling by using dedicated error labels with an "err" prefix. Note that the endpoint lookup helper returns -ENXIO when endpoints are missing which is functionally equivalent to returning -ENODEV. Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 0001477463a3..28e2a536a309 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4055,10 +4055,8 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D usb_find_common_endpoints(intf->cur_altsetting, &data->bulk_rx_ep, &data->bulk_tx_ep, &data->intr_ep, NULL); - if (err) { - kfree(data); - return -ENODEV; - } + if (err) + goto err_free_data; =20 if (id->driver_info & BTUSB_AMP) { data->cmdreq_type =3D USB_TYPE_CLASS | 0x01; @@ -4114,8 +4112,8 @@ static int btusb_probe(struct usb_interface *intf, =20 hdev =3D hci_alloc_dev_priv(priv_size); if (!hdev) { - kfree(data); - return -ENOMEM; + err =3D -ENOMEM; + goto err_free_data; } =20 hdev->bus =3D HCI_USB; @@ -4129,7 +4127,7 @@ static int btusb_probe(struct usb_interface *intf, GPIOD_OUT_LOW); if (IS_ERR(reset_gpio)) { err =3D PTR_ERR(reset_gpio); - goto out_free_dev; + goto err_free_hdev; } else if (reset_gpio) { data->reset_gpio =3D reset_gpio; } @@ -4145,7 +4143,7 @@ static int btusb_probe(struct usb_interface *intf, #ifdef CONFIG_PM err =3D btusb_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_put_reset; =20 /* Marvell devices may need a specific chip configuration */ if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { @@ -4391,11 +4389,14 @@ static int btusb_probe(struct usb_interface *intf, device_init_wakeup(&data->udev->dev, false); free_irq(data->oob_wake_irq, data); } -out_free_dev: +err_put_reset: if (data->reset_gpio) gpiod_put(data->reset_gpio); +err_free_hdev: hci_free_dev(hdev); +err_free_data: kfree(data); + return err; } =20 --=20 2.52.0