From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68ADB3A9DB3; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497451; cv=none; b=H3s7Z97Z6MwQWKBs3SgHfQamCIj7m5pR/uWQ+EZUzvyfJgU8gyCqpP23dK2lzUgNS9BoAlBdG7NQP5GbXubts+QXbxuTysxgQ1hsS+ZDMmzSoYNxcYOg30d93zjNXL6JcfU6uZsnYxoiDl5vj26yedn18EQljLQPWemiHnNfm08= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497451; c=relaxed/simple; bh=iWYLb+jVZMsFPoBRU/cZPtm+NLhB9eO6Z5NJ+oly4SU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=depJ0+67jZASIYTg+f6Vg9qIPkoZZJfhxGK2tI90Qtja7pGk5GsdgGbJMox24R/5XccrDBZmYxvmftPQiA0JyIADYCnJwMwFe6AVLODNuHLE6AoTLoyTuHPP1dndslVT4KITBfMPdHVSJoahP5rTzCywqgfihwXP60Q5n0W8JW4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HH/8hFFF; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HH/8hFFF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2DBEA1F0089B; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780497449; bh=TAekpMO3Kp6EnSvtFnl+boRFm6phDluCxfDXcPqRAVk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=HH/8hFFF40ciaFYxmGLXpK10JT/7y45i0d8Qp2Fso/xu0BJ4XCVscs8RjMdqmkiDS mk6o30llgyEe/iv91pg7sx3bmsOYTv0gBKEAsYeiO5yOxJYvmjMmwOj/zPn30sw3BB bAw9CVaN22C6kiPd3ptacN1/5D9GOI9XI0q1gzftHeduJ5FYQD3ACOwEeQE0lypjwh QR1TaOlRXI4h0LARVnC6KVs/5h3KuKIkFmnmXvp6f4LE87RhvHK8JWRS+/1F2/jY/h 5IHRyGitOogddW/toS1uVM5LImd98hdYPP55FSAjS0rVVqvboivS/AKIShJbojOCZj Rg6i1fxlPrJnQ== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wUmik-0000000AYAy-34eq; Wed, 03 Jun 2026 16:37:26 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Paul Menzel Subject: [PATCH v3 RESEND 1/5] Bluetooth: btusb: fix use-after-free on registration failure Date: Wed, 3 Jun 2026 16:36:39 +0200 Message-ID: <20260603143643.2514595-2-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260603143643.2514595-1-johan@kernel.org> References: <20260603143643.2514595-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kerne= l.org Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver") Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG in= terface") Cc: stable@vger.kernel.org # 2.6.27 Reviewed-by: Paul Menzel Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 830fefb342c6..c8015cee240f 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4407,7 +4407,7 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D hci_register_dev(hdev); if (err < 0) - goto out_free_dev; + goto err_release_siblings; =20 usb_set_intfdata(intf, data); =20 @@ -4416,6 +4416,15 @@ static int btusb_probe(struct usb_interface *intf, =20 return 0; =20 +err_release_siblings: + if (data->diag) { + usb_set_intfdata(data->diag, NULL); + usb_driver_release_interface(&btusb_driver, data->diag); + } + if (data->isoc) { + usb_set_intfdata(data->isoc, NULL); + usb_driver_release_interface(&btusb_driver, data->isoc); + } out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68B6A3AA1B5; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497450; cv=none; b=NuIfk8ZQBsm9Z0CT7iXGqJG4tYVDuXkttV7rkIdTd6n7loKYxoSHU1HILuwS/o+W8kBNoBQQyExhDLsF1JtKiYazd7XafKbLNKHRM4OehFyswtT5EuCaAxplSSynMDbfEkShYDGJRPzf4p6GdIvwO6C71DII8Swzx2Hwz4qGyu8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497450; c=relaxed/simple; bh=zcn1dK/29EDlDuUjELmkDL4xNInnWxDqRDZS9QfhRPg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BRt2jmc35k7xtvTdb3I2lFsby9qaYd8eUDbCUXDVa36FZasejXpZhQ/DrBqpglbZ6ZBQEGDqkt8HAcR/Zt3p1128byVGN2KHkBSxpbCtLrgwJCid6WHUw9qPFZSUOve7d+dHGgK5ITA9eINErzXF5LlQvLiYtX/uGrLhxWqu8uA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fpbhsxjB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fpbhsxjB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18F591F00893; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780497449; bh=fqO4LZkLQ5FT3GK1shuzVv/gvIRfqdWBmfuDHOglRjQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=fpbhsxjBaAq7gaOcNGbE7pCZ+Sa52LF2PKsVNqv99+RTrxWKjQ/UveS+G41+2Vped HbKF71khqgYCbLJXN4dbnVWMx7Um8XAXJhRSqIefy6VCi6GzqiBnIErKkvok7sNuYW hJmJLjR0aAFWObLOGA+oIyP8FtVdIUFeLxb2qKVc63tJTGkxsdXuldpkaxsqNNIIDS hz7ie65Z2mro96ZVoPFXzoI88/nuXV7LCG5K6RuSVHb83qxZVOZ1m74a69aGoVGMuT j2hn4uolKjeGiggVAi8EqFHPbHRz7AzgIWvYOxhwhbdWC4WfWySJ3x8w+8SofESB10 2yAONO6eX6L9g== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wUmik-0000000AYB1-373j; Wed, 03 Jun 2026 16:37:26 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Rajat Jain Subject: [PATCH v3 RESEND 2/5] Bluetooth: btusb: fix use-after-free on marvell probe failure Date: Wed, 3 Jun 2026 16:36:40 +0200 Message-ID: <20260603143643.2514595-3-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260603143643.2514595-1-johan@kernel.org> References: <20260603143643.2514595-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kerne= l.org Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the= pins for oob wakeup") Cc: stable@vger.kernel.org # 4.11 Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index c8015cee240f..d0a83a1ffdf2 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4218,7 +4218,7 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_INTEL_COMBINED) { err =3D btintel_configure_setup(hdev, btusb_driver.name); if (err) - goto out_free_dev; + goto err_kill_tx_urbs; =20 /* Transport specific configuration */ hdev->send =3D btusb_send_frame_intel; @@ -4381,7 +4381,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_set_interface(data->udev, 0, 0); if (err < 0) { BT_ERR("failed to set interface 0, alt 0 %d", err); - goto out_free_dev; + goto err_kill_tx_urbs; } } =20 @@ -4389,7 +4389,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_driver_claim_interface(&btusb_driver, data->isoc, data); if (err < 0) - goto out_free_dev; + goto err_kill_tx_urbs; } =20 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) { @@ -4425,6 +4425,8 @@ static int btusb_probe(struct usb_interface *intf, usb_set_intfdata(data->isoc, NULL); usb_driver_release_interface(&btusb_driver, data->isoc); } +err_kill_tx_urbs: + usb_kill_anchored_urbs(&data->tx_anchor); out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 689483A8FF6; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497450; cv=none; b=sw3Wbr8AAYCzlLO3TZ+JhCbdK/ySVwmdt3uFmQxgEVqsXEO4oHH64uJQlU2HLEljAHL9tJm2/oa8HV4djJ3PTV6N5hcatoU679cl6TqWWXYggpFO+eacSzO2BUt+Y12BHkqGxuBWD4xdqmC081vRNUFv5uQzeoZcvnyXinzFQow= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497450; c=relaxed/simple; bh=h3jJ/nP5pLr7CBwRObS7zzhELWONPHjzqZR0+am6cdU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MzoXcUxxE3s0IN9HHnFKD3W1VTix2xu1clUoyDzJBh2bU3PwmJKobvPjAdI9Ni56MsKpJbN6+JKESiTzJfqit02KL4nH0xmSBY7n7vN0JkTYhihw6KjiDZ5iXGZIaVnmoVEIbRZgr4dm2siPOB/TWMZT2qHROQS95oRFb9Mog0w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bPBQW5U6; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bPBQW5U6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19EDF1F00899; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780497449; bh=YhkoW0rRlfHoFhzX5mfolI/l6SS5hCwW3qRrR7GxDsw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bPBQW5U6C9YC9R1JF9ZIVIIBCvvGeuyNSpEDimbvlkrYB4+GPhYAPP7ZI9zzjFuHN bhfcKKxtttKTYXnbSu0QkYS3stuyYFSywYdxZwmhTT4L/rihq0yUtjkE8NgSbSTsF0 /tgYG8E8hTsI6/FjOQckUJ4zbNi7Tmg2Snkxk9DFlO5oCqD6KhID2ligSsV/i+RJ7F NeqeN2SODslxFFIahtfI58Tb+l9mNeR3wwAVijbps2Mylc4M0to1vZLRMt3lmAxr9x 08fPR0UH0gXREVtBRrjvbCqhXbQixhNgmkQMxLXmypHw+2QndEc5xeBgYnqMhsRqub yeD8DMq0mSlqQ== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wUmik-0000000AYB4-39Qt; Wed, 03 Jun 2026 16:37:26 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Rajat Jain Subject: [PATCH v3 RESEND 3/5] Bluetooth: btusb: fix wakeup source leak on probe failure Date: Wed, 3 Jun 2026 16:36:41 +0200 Message-ID: <20260603143643.2514595-4-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260603143643.2514595-1-johan@kernel.org> References: <20260603143643.2514595-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to disable wakeup on probe failure to avoid leaking the wakeup source. Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: stable@vger.kernel.org # 4.11 Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index d0a83a1ffdf2..622df2fff497 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4181,7 +4181,7 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { err =3D marvell_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_disable_wakeup; } #endif if (id->driver_info & BTUSB_CW6622) @@ -4427,6 +4427,9 @@ static int btusb_probe(struct usb_interface *intf, } err_kill_tx_urbs: usb_kill_anchored_urbs(&data->tx_anchor); +err_disable_wakeup: + if (data->oob_wake_irq) + device_init_wakeup(&data->udev->dev, false); out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A879D47DF8F; Wed, 3 Jun 2026 14:37:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497452; cv=none; b=re0SgESFh+eSUgQwX5hHXgp6M9LCbOxZNnMB2Y6cWeyt9fy77cW9fM9NhHUyL7nf+eauX2USNuJBm0KfPK55HCFIz3hwN19mZh9xv3BldvfHJeVuHnXe156bpg1LhKTMg+ce6ohvx3xvT3xCBHmATQEKOcBtkrpRv+IKu4cOR+s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497452; c=relaxed/simple; bh=ZTMs/JG5ZExpxDrRxlzy7vlto7pTpYFGaCCLhKvpUMw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Insvqn/mlaPxU1+QbH+/SAl1pDIf+TYNriQKWhhRD6R9P8uqWE6EOFIQCyNTNC0i3JB1F+jjbbQT95w43BlHW0Nuw5n7EOn9OiEbkaqoosrWpDY3So44BxuBxzQjvqUlI9CKeVMwkhuAoTkLwHKcKGqw1RA60JAcqFX7tplHSXU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Nxyj8Ijb; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Nxyj8Ijb" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D01F1F0089C; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780497449; bh=Y/IN4P09rZ58FdY/EKLm5RE3U4EEjJCNUePEuJlPask=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Nxyj8IjbfIQevlUFCR4+hQfJJvCdI7XzYXWvg3qY+uwd00bMgKbtsqqhvaDGsjZ1a r5fIFNEcqGuHpLBts3iHoV0wFCsm80OUWeh9ZmTi/QP1NU+1VQpRP+GMpjonDaw3ee XjLYuAoDARtbEP1f2A/rWxan0VFL/bAsf2CyCpctlJQBpT7fPAUPXmcR+zWFxMhRFT HGbv6ze0UqaO6Tx+aHpJ1xRycvVSA5WuS0F49sC+d4I4urKjUWv2Ni2GJVlViGr1gL t/fcGKipOEP8OH9jPyKKN01FLKi3yTlfyIRcPJY1IJbJ+IXgcMAWjJdJ203xhu4dqa tnkMfaBY7DsUQ== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wUmik-0000000AYB7-3BqD; Wed, 03 Jun 2026 16:37:26 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Rajat Jain Subject: [PATCH v3 RESEND 4/5] Bluetooth: btusb: fix wakeup irq devres lifetime Date: Wed, 3 Jun 2026 16:36:42 +0200 Message-ID: <20260603143643.2514595-5-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260603143643.2514595-1-johan@kernel.org> References: <20260603143643.2514595-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The OOB wakeup interrupt is device managed but its lifetime is incorrectly tied to the child HCI device rather than the USB interface to which the driver is bound. This should not cause any trouble currently as the interrupt will be disabled when the HCI device is deregistered on disconnect (but this was not always the case, see [1]), and there should be no further references if probe fails before registering it. But it is still technically wrong as the reference counted HCI device could in theory remain after a probe failure. Explicitly free the interrupt on disconnect so that it is guaranteed to be disabled before freeing the (non-managed) driver data (including if disconnected while suspended). [1] 699fb50d9903 ("drivers: base: Free devm resources when unregistering a device") Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 622df2fff497..450c8746bea6 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3819,8 +3819,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev) } =20 irq_set_status_flags(irq, IRQ_NOAUTOEN); - ret =3D devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, - 0, "OOB Wake-on-BT", data); + ret =3D request_irq(irq, btusb_oob_wake_handler, 0, "OOB Wake-on-BT", dat= a); if (ret) { bt_dev_err(hdev, "%s: IRQ request failed", __func__); return ret; @@ -3829,12 +3828,18 @@ static int btusb_config_oob_wake(struct hci_dev *hd= ev) ret =3D device_init_wakeup(dev, true); if (ret) { bt_dev_err(hdev, "%s: failed to init_wakeup", __func__); - return ret; + goto err_free_irq; } =20 data->oob_wake_irq =3D irq; bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); + return 0; + +err_free_irq: + free_irq(irq, data); + + return ret; } #endif =20 @@ -4428,8 +4433,10 @@ static int btusb_probe(struct usb_interface *intf, err_kill_tx_urbs: usb_kill_anchored_urbs(&data->tx_anchor); err_disable_wakeup: - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); @@ -4462,8 +4469,11 @@ static void btusb_disconnect(struct usb_interface *i= ntf) =20 hci_unregister_dev(hdev); =20 - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } + if (data->reset_gpio) gpiod_put(data->reset_gpio); =20 --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68A343A961E; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497450; cv=none; b=QsR9pKz5nZO0XpNXmuJceO5SZl4eysQzOnf9ahgF7KjIOco1ZuQxXoZhcQIofjiLEzjamHAc1E7QQiZXOGoXwex9QX7gu0DkeXsXvc1Vu42ba55WcXWPCfwF08LYmLYfERCgkatbuAgoqNA1DjhF7BeC9NZ9yapT9CcXcnGi3ag= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780497450; c=relaxed/simple; bh=eGIUkkDeHIoabRpC/swsReB/e1STf58GKDlMA+oD6tw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Y5aYSNJI49eBejqtkKM0is3xUrQG03igM+ycB41vu78/TvgrDZIVtOLekb3Sp2dUshk9HSp46iebBMc0sRvr7k/tOdIYP9c+8GTaFrVbSDZvKdRfKTLb3IK4VWQ+tgiaatUWpOQGv6D5HA1qLz4snh9h2W7DxZg/WdZdwFdUEGY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KQT62A2H; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KQT62A2H" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D0A41F0089A; Wed, 3 Jun 2026 14:37:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780497449; bh=MxCEcu+ZTRXj48YJ5EIbCe8X2ETMhTGE/bvVh2HH67M=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=KQT62A2Ho7r2ZO50eJ8T/uo7hGaxYcgxoYlu40P6eSDsNCuiofJ2/b/xWhCzXi0Fc rTmRsXNco+yHDEgHPT2tAaeO0F7cLGjN6iVH6QIQdocyD1oIrQlBB/t4YA8+T1XrPR 1v310JwZD+b6ascyThMHhEOP9dcpBuVFpq3XTmSXutVShULNdLEbcJMoW3O9d8PfuG f1OsZlz77XYpBwGbaxeo0LI8P+12WkCTCMaJmN6DzKvG54TpH5o9wxj7xqQmH7rzQT JgbnE7nVVqNnEIUiIdMeL34nSD8WIKHtN/2VFw35hC/KAPqcamfk7rChzjikOdnAf3 bSOM8W/oWzmPw== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wUmik-0000000AYBA-3EP8; Wed, 03 Jun 2026 16:37:26 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v3 RESEND 5/5] Bluetooth: btusb: clean up probe error handling Date: Wed, 3 Jun 2026 16:36:43 +0200 Message-ID: <20260603143643.2514595-6-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260603143643.2514595-1-johan@kernel.org> References: <20260603143643.2514595-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clean up probe error handling by using dedicated error labels with an "err" prefix. Note that the endpoint lookup helper returns -ENXIO when endpoints are missing which is functionally equivalent to returning -ENODEV. Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 450c8746bea6..83fbb5d2bf4a 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4090,10 +4090,8 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D usb_find_common_endpoints(intf->cur_altsetting, &data->bulk_rx_ep, &data->bulk_tx_ep, &data->intr_ep, NULL); - if (err) { - kfree(data); - return -ENODEV; - } + if (err) + goto err_free_data; =20 if (id->driver_info & BTUSB_AMP) { data->cmdreq_type =3D USB_TYPE_CLASS | 0x01; @@ -4149,8 +4147,8 @@ static int btusb_probe(struct usb_interface *intf, =20 hdev =3D hci_alloc_dev_priv(priv_size); if (!hdev) { - kfree(data); - return -ENOMEM; + err =3D -ENOMEM; + goto err_free_data; } =20 hdev->bus =3D HCI_USB; @@ -4164,7 +4162,7 @@ static int btusb_probe(struct usb_interface *intf, GPIOD_OUT_LOW); if (IS_ERR(reset_gpio)) { err =3D PTR_ERR(reset_gpio); - goto out_free_dev; + goto err_free_hdev; } else if (reset_gpio) { data->reset_gpio =3D reset_gpio; } @@ -4180,7 +4178,7 @@ static int btusb_probe(struct usb_interface *intf, #ifdef CONFIG_PM err =3D btusb_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_put_reset; =20 /* Marvell devices may need a specific chip configuration */ if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { @@ -4437,11 +4435,14 @@ static int btusb_probe(struct usb_interface *intf, device_init_wakeup(&data->udev->dev, false); free_irq(data->oob_wake_irq, data); } -out_free_dev: +err_put_reset: if (data->reset_gpio) gpiod_put(data->reset_gpio); +err_free_hdev: hci_free_dev(hdev); +err_free_data: kfree(data); + return err; } =20 --=20 2.53.0