From nobody Sat Apr 4 03:04:26 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15AF23DFC98; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; cv=none; b=WBHD+kxJNYwkKp6L3OYULWmi3ndp3ajMAKwqvRIkCGbxaNNjUQRpTGTB8/oY+lF+BhzroIYycCEpv/PYOb8JcvniNyLWuUDKw54hJNqgsnrAJBiqqH7HGpYBFjHcKvTf9gNlNGEuOeIo5NZkj6o5PW4x1kFPUbRGuY8PTRw6ex8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; c=relaxed/simple; bh=VL5LBw99FRqrEC5kFcGQ9UvBX6IvWRUeRbZCGJ/xtvM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ENVA8gCSZTDJ+R1i7JIEJB5C91crmcaIp/xt00w/VxabPHnZy5vxCgTpdoSCXkv1C7kPFV8zQ7Ih3smODSeCzhaxg97pmQOMHIEV5Wq0cSpNy7JsXgAuK3YxVqsOih3hXwAs/A5Ku9HM1Xrn3/edMqrf1gtvKRSbcEgUXgAAMyk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=F41NZasR; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="F41NZasR" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1904C4AF0B; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775144988; bh=VL5LBw99FRqrEC5kFcGQ9UvBX6IvWRUeRbZCGJ/xtvM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F41NZasRETl/Z6T1sqazPHpz2jx14eVbzBEBwndFzIWT/YVIp9HgrQnjIbvk9LHzI AMs1Qxm909CwowWYk5oc+wKbVsA7GtNuZkWIfD9/tuQhtMK773SoFQkQIj73IbFZxc uPc9R9BxEpmP4bDV0KO6jx0ftccvupHpdMgO8Gl/LAJNXFAbPWglTLHcGzfo9ay0D0 BVDutsekGWO/HphfxneKks4mcZlR9bmrL7lFvtDk/c1TzjQQaW4GC/YkmJMs3F9KYU 3QDAF96LIMHvjxo1oRH4YfVn90vwpmko72etSMQ+qH1zvyDHLh74xX4yQp7HPMMnJq j4IaxXa/vinfQ== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8KIk-0000000ALvO-24qN; Thu, 02 Apr 2026 17:49:46 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org Subject: [PATCH v3 1/5] Bluetooth: btusb: fix use-after-free on registration failure Date: Thu, 2 Apr 2026 17:48:06 +0200 Message-ID: <20260402154810.2467291-2-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402154810.2467291-1-johan@kernel.org> References: <20260402154810.2467291-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kerne= l.org Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver") Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG in= terface") Cc: stable@vger.kernel.org # 2.6.27 Signed-off-by: Johan Hovold Reviewed-by: Paul Menzel --- drivers/bluetooth/btusb.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 21e85c212506..97de6e6e7dbc 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4372,7 +4372,7 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D hci_register_dev(hdev); if (err < 0) - goto out_free_dev; + goto err_release_siblings; =20 usb_set_intfdata(intf, data); =20 @@ -4381,6 +4381,15 @@ static int btusb_probe(struct usb_interface *intf, =20 return 0; =20 +err_release_siblings: + if (data->diag) { + usb_set_intfdata(data->diag, NULL); + usb_driver_release_interface(&btusb_driver, data->diag); + } + if (data->isoc) { + usb_set_intfdata(data->isoc, NULL); + usb_driver_release_interface(&btusb_driver, data->isoc); + } out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.52.0 From nobody Sat Apr 4 03:04:26 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 159ED3CBE72; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; cv=none; b=MKoOqbYJfHd7ZlbPlQ6/Y/qxA8gJZUEc1Cf3fylxwU5itheDjbaX9wIuv9powMDM4buZJKvvg44m8QqTFjKQD38R3W2ZIS5g82aOEGGkwDZ1kcm5k2XtykxPq7gCDFZoJvzh4A/ZZk9LvBNHLbNaVrOlQPHhvj2Smb4W5Zna5K4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; c=relaxed/simple; bh=XpuoG8mvycp03fgAimW2iAGcsycTMXVNftW28CIwid0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=KCAdXs1MJKCoUCnC39MUCIdSwD1ezEmS2NvQr1X5aJys1h+MECBz8zEhPLRNOnyaZ1hqPV7IQ6u+iYKkSTEryoby5+vFpmENiWcSsowiWwM9KaNq9C5DTZR871HJilRamdlY6VvOsgChFfwVgpi1IE5NYFjljkkxHTeUpTd+aZE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=IBwm3z/r; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="IBwm3z/r" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C18A8C116C6; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775144988; bh=XpuoG8mvycp03fgAimW2iAGcsycTMXVNftW28CIwid0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IBwm3z/rNqQW8v6IflGSzqUxuShah55UPnHwpll5A1z28si50HEtea1N3umg+vmuW afaqx+Smv0aWg9UbeV86RmUwAtke4XUuhxtHQteeAUSKF5B0uX9E2cfqE+p8T+8gdn yjop/11TaknCUtVY1Q3lTrBE72Z1I4ZThMXD+u5WvXIEXsQd0Qp+oa0y/p0linwMo+ tfmB1sLghiC6mlBINTA9CU6VPTW7j+h1ZDUo1C6ZBYPB7QL74kxhyFndmBoGebDKl4 XLCGEqdUDCUdDIh/6okVAEAPh8/PDiQERWOwk90FzvbTyS2d9k1leXgwKEuTk/bt0w SXB/V1Xz9/36A== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8KIk-0000000ALvQ-27LT; Thu, 02 Apr 2026 17:49:46 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Rajat Jain Subject: [PATCH v3 2/5] Bluetooth: btusb: fix use-after-free on marvell probe failure Date: Thu, 2 Apr 2026 17:48:07 +0200 Message-ID: <20260402154810.2467291-3-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402154810.2467291-1-johan@kernel.org> References: <20260402154810.2467291-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kerne= l.org Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the= pins for oob wakeup") Cc: stable@vger.kernel.org # 4.11 Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 97de6e6e7dbc..b6f2bed7d1b8 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4183,7 +4183,7 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_INTEL_COMBINED) { err =3D btintel_configure_setup(hdev, btusb_driver.name); if (err) - goto out_free_dev; + goto err_kill_tx_urbs; =20 /* Transport specific configuration */ hdev->send =3D btusb_send_frame_intel; @@ -4346,7 +4346,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_set_interface(data->udev, 0, 0); if (err < 0) { BT_ERR("failed to set interface 0, alt 0 %d", err); - goto out_free_dev; + goto err_kill_tx_urbs; } } =20 @@ -4354,7 +4354,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_driver_claim_interface(&btusb_driver, data->isoc, data); if (err < 0) - goto out_free_dev; + goto err_kill_tx_urbs; } =20 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) { @@ -4390,6 +4390,8 @@ static int btusb_probe(struct usb_interface *intf, usb_set_intfdata(data->isoc, NULL); usb_driver_release_interface(&btusb_driver, data->isoc); } +err_kill_tx_urbs: + usb_kill_anchored_urbs(&data->tx_anchor); out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.52.0 From nobody Sat Apr 4 03:04:26 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2CBE35F165; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; cv=none; b=aE4vbXu/atvNee7SjQAmDSHGCQ7Hlo2vgPRTb1IKFYeIZxhAqGQ5/KU2iOsToFK2ClJvr6vklHeor7OGdSTRluJzfUu1o6YWV+fEwM+McOzobZPImqXQws9gq4bK0I71nhJixIfP6HqX6k4dROknl1JHg0ZGsr0Lyeh7cf73hks= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; c=relaxed/simple; bh=5w5cMnbQ8S9gKwWMF2Qihh0+orwPNLrNq9f+yaKIYbQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IO2FoBpvw4cv9ayY7+ouPAljzQUs5mLFdvD7kO+Zm0cXYB2CHwhTHqlle/VgPX9NsOa4sapOlFaKvs7N9uy2k3OsOXlCzHMDt4/vF3NLFqcIKWDWkmIkjsJKq3R8K5HE1OMBJZbsXrIMRWEub5Rtn8g5sLKKm8I6lIezi7AOdKA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=pL230CIx; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="pL230CIx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C273AC4AF0C; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775144988; bh=5w5cMnbQ8S9gKwWMF2Qihh0+orwPNLrNq9f+yaKIYbQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pL230CIx5VX20b1Wj67I/WC8L9e0cYR/10pRMzqSWsiGbt+D8M/25YmUPHNCcNqeb x3IYnl3P4zlbwYyV5h2VDEG1CyS7qsZvTG6QrBxsey32I1Nbf67h4YFgqPXWOCZBZZ Cwg4zU6vlweUoW1FvXZ6vgyY7vt537a1Q518pBbnhHg/LtPMEd9S0DomwRtsADCaKf nF0os2i6MU62ZVfTursHjeUOS4JkGVqHD1jIQi3nBrL7i5TrKMyTYxXc/5D8sdnV6F lUKpbwIq9SEHqUjx+tppjmV77I2+JuEzSQaRMOTkiB/c6Do/0KLfdW0ejIFEM3917u 6dcX8cZmrLfSw== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8KIk-0000000ALvS-29mI; Thu, 02 Apr 2026 17:49:46 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Rajat Jain Subject: [PATCH v3 3/5] Bluetooth: btusb: fix wakeup source leak on probe failure Date: Thu, 2 Apr 2026 17:48:08 +0200 Message-ID: <20260402154810.2467291-4-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402154810.2467291-1-johan@kernel.org> References: <20260402154810.2467291-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to disable wakeup on probe failure to avoid leaking the wakeup source. Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: stable@vger.kernel.org # 4.11 Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index b6f2bed7d1b8..cb0d40a7af8f 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4146,7 +4146,7 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { err =3D marvell_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_disable_wakeup; } #endif if (id->driver_info & BTUSB_CW6622) @@ -4392,6 +4392,9 @@ static int btusb_probe(struct usb_interface *intf, } err_kill_tx_urbs: usb_kill_anchored_urbs(&data->tx_anchor); +err_disable_wakeup: + if (data->oob_wake_irq) + device_init_wakeup(&data->udev->dev, false); out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.52.0 From nobody Sat Apr 4 03:04:26 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FDAE3E1CE0; Thu, 2 Apr 2026 15:49:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; cv=none; b=FmuumLC2Qb7GxseA0TrfENo+NWeSeWld0wQJGRKRpcoavqY90zvvzoSxVYDaD8CPcT9PBjFPA+nllK605cCZfUbVe6kqmq2P3teL04v2Gw+i0Dhd7lBn5DM4j0M9S8XTBInPOs0Ce+D6gZTtWagCupCRE+1kS7xpd6+b07KgRWo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; c=relaxed/simple; bh=9dJNGOci2T1uYQXSXxoyli4dP9j6zsXiSaDLyLrKXXI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NyOe4wTdmjQokg0R5e88qb3305oH9eD4sYThwLxlfffFO2bTTPF38COSkdv4HGudk6R+pK4eVzhBVDwHx1PrpqwHo7S7oLtLWcy2CkAeI1cBrOh/C1NnmSNLWlLS9+FOD9iXLp7oeQtHWNfy16xmkQQ9koDoVi62FCcQhGgrIY8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ehE6p5O7; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ehE6p5O7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9B14C2BC9E; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775144988; bh=9dJNGOci2T1uYQXSXxoyli4dP9j6zsXiSaDLyLrKXXI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ehE6p5O78i2PNAhuC7ukdpSMMbHQPm4RW+Z2wAL3Odi+6TNv+j1FL7yyadybTbsMo 8pNnSazlO/XiG7aeNdonOsDx3ix/e0VVaVIHExfrPiqU6A5gZefOKwdFOfA1lcBDaN 9WNAuinWjt2j56D2WEgeLqgAFc3/FxcZ20y8VHLfBMWpMdonCfAXmVgbbRE61aXerj WmoRUhcPW2h6Gj0h+w88lFjf/6mPpgfjs+1+CSzvpaj9uel0m7bui4ECS5V//NlWZM L267eEKIzX31sorfj+KWC6WadtXrhJ6TfjvLMcD9jL8ElndCE/zuRzYN0uWpKjbSK+ ZejbLV05vkYTA== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8KIk-0000000ALvU-2CIh; Thu, 02 Apr 2026 17:49:46 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Rajat Jain Subject: [PATCH v3 4/5] Bluetooth: btusb: fix wakeup irq devres lifetime Date: Thu, 2 Apr 2026 17:48:09 +0200 Message-ID: <20260402154810.2467291-5-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402154810.2467291-1-johan@kernel.org> References: <20260402154810.2467291-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The OOB wakeup interrupt is device managed but its lifetime is incorrectly tied to the child HCI device rather than the USB interface to which the driver is bound. This should not cause any trouble currently as the interrupt will be disabled when the HCI device is deregistered on disconnect (but this was not always the case, see [1]), and there should be no further references if probe fails before registering it. But it is still technically wrong as the reference counted HCI device could in theory remain after a probe failure. Explicitly free the interrupt on disconnect so that it is guaranteed to be disabled before freeing the (non-managed) driver data (including if disconnected while suspended). [1] 699fb50d9903 ("drivers: base: Free devm resources when unregistering a device") Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index cb0d40a7af8f..04fed3d146ef 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3784,8 +3784,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev) } =20 irq_set_status_flags(irq, IRQ_NOAUTOEN); - ret =3D devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, - 0, "OOB Wake-on-BT", data); + ret =3D request_irq(irq, btusb_oob_wake_handler, 0, "OOB Wake-on-BT", dat= a); if (ret) { bt_dev_err(hdev, "%s: IRQ request failed", __func__); return ret; @@ -3794,12 +3793,18 @@ static int btusb_config_oob_wake(struct hci_dev *hd= ev) ret =3D device_init_wakeup(dev, true); if (ret) { bt_dev_err(hdev, "%s: failed to init_wakeup", __func__); - return ret; + goto err_free_irq; } =20 data->oob_wake_irq =3D irq; bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); + return 0; + +err_free_irq: + free_irq(irq, data); + + return ret; } #endif =20 @@ -4393,8 +4398,10 @@ static int btusb_probe(struct usb_interface *intf, err_kill_tx_urbs: usb_kill_anchored_urbs(&data->tx_anchor); err_disable_wakeup: - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); @@ -4427,8 +4434,11 @@ static void btusb_disconnect(struct usb_interface *i= ntf) =20 hci_unregister_dev(hdev); =20 - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } + if (data->reset_gpio) gpiod_put(data->reset_gpio); =20 --=20 2.52.0 From nobody Sat Apr 4 03:04:26 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1578A3AD50A; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; cv=none; b=OunnEPH+DeCjmvNDTD3gKYJy1PTVvBYUB2VZfLlovK02wrhXxzYJU4zywxfhjJO+6PWKwLdmuNS0i+KDiGlg3CU2bMmmdzQo/QIwDKXnaVTTR0Ia3WYrERk5KwzbZ59xA+w4dyxmHh72Ob5qIgwqqvONwc4McH4fn8hRJe9fa6s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775144989; c=relaxed/simple; bh=rpkf5w8yDhKheG+qWK9WQyHwNrTiq9e9Px5AXhtt8cQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Cl8j9R8KTyO6nxKwLu/JQpTipfZP8dmtv/+LRYz0JOe24Rzoxsr68X/e4ZfqWI7qwW8qvut3wmUOoDScYmwoZRsIITukUWuR+/4jfrswRFaS1Pwn2TrFbVk1XZwJxewoNd3v4xYlo1mJG7+ldQ/y7StMXPRKBDe/Mx2M9WqS9j0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=R2mMe26h; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="R2mMe26h" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C18DBC19423; Thu, 2 Apr 2026 15:49:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1775144988; bh=rpkf5w8yDhKheG+qWK9WQyHwNrTiq9e9Px5AXhtt8cQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R2mMe26hRmy+DCCq8YV6Obefb6KwebMqsaVivZe7eXP93NQI5q2H60Svb/QxCqcla C2UYsnBve7jlobSVMjGgCjcT1jiVqrNnYyIDlQEOXNUs3O/ZeYIN5DVMx99gSLD1To atpyELR1QwSddr8KdznaVJicCX8ypMdmgB/bFybaGssPZbd95xVAzukdftFcHc6Ar1 C6Ems4xl452zBjGwOCJUEHlou9fEd15mxOKIEX6tYXEqDFeCGycPPVGnR0DWCVkOHF 7jplj3DyrsqlzsiMwH7wIGUxQ+KwnQ2Oz4mKo3YWlqilQRV4PJazFDKgn6ZJIZWU7x w52YHtLiG0EXg== Received: from johan by xi.lan with local (Exim 4.98.2) (envelope-from ) id 1w8KIk-0000000ALvW-2Eff; Thu, 02 Apr 2026 17:49:46 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v3 5/5] Bluetooth: btusb: clean up probe error handling Date: Thu, 2 Apr 2026 17:48:10 +0200 Message-ID: <20260402154810.2467291-6-johan@kernel.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260402154810.2467291-1-johan@kernel.org> References: <20260402154810.2467291-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clean up probe error handling by using dedicated error labels with an "err" prefix. Note that the endpoint lookup helper returns -ENXIO when endpoints are missing which is functionally equivalent to returning -ENODEV. Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 04fed3d146ef..13f757aa0bf0 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4055,10 +4055,8 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D usb_find_common_endpoints(intf->cur_altsetting, &data->bulk_rx_ep, &data->bulk_tx_ep, &data->intr_ep, NULL); - if (err) { - kfree(data); - return -ENODEV; - } + if (err) + goto err_free_data; =20 if (id->driver_info & BTUSB_AMP) { data->cmdreq_type =3D USB_TYPE_CLASS | 0x01; @@ -4114,8 +4112,8 @@ static int btusb_probe(struct usb_interface *intf, =20 hdev =3D hci_alloc_dev_priv(priv_size); if (!hdev) { - kfree(data); - return -ENOMEM; + err =3D -ENOMEM; + goto err_free_data; } =20 hdev->bus =3D HCI_USB; @@ -4129,7 +4127,7 @@ static int btusb_probe(struct usb_interface *intf, GPIOD_OUT_LOW); if (IS_ERR(reset_gpio)) { err =3D PTR_ERR(reset_gpio); - goto out_free_dev; + goto err_free_hdev; } else if (reset_gpio) { data->reset_gpio =3D reset_gpio; } @@ -4145,7 +4143,7 @@ static int btusb_probe(struct usb_interface *intf, #ifdef CONFIG_PM err =3D btusb_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_put_reset; =20 /* Marvell devices may need a specific chip configuration */ if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { @@ -4402,11 +4400,14 @@ static int btusb_probe(struct usb_interface *intf, device_init_wakeup(&data->udev->dev, false); free_irq(data->oob_wake_irq, data); } -out_free_dev: +err_put_reset: if (data->reset_gpio) gpiod_put(data->reset_gpio); +err_free_hdev: hci_free_dev(hdev); +err_free_data: kfree(data); + return err; } =20 --=20 2.52.0