From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C4103D1A9A; Thu, 4 Jun 2026 06:39:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555148; cv=none; b=PvDGgbnNlUIYx9/ADuVmf/HNKfK7l7cbSsBUCgcde4wqDejxWSMzsjdpOILAY68K3ANNRrFotO12/pWqjOECkWjnh8Rh99LVfPRbeCfQo3qoJHvoLRd2wf5wg3jJNsGmMtNZDV8OMdGti3TH/wzs0/jIckVF/OCXIzLYNsEzj/s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555148; c=relaxed/simple; bh=iWYLb+jVZMsFPoBRU/cZPtm+NLhB9eO6Z5NJ+oly4SU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fc6wYv8mXpkFAw/eEE1mLySK1/7OKKp/GvKiYgUr7rDy1dB/ALK/5qVWsDToPs5Q9mp0s4rm5khMKqsmx6d6OKCKpaWDJzTrDUftZ0l90ZOFCsJgMvN8kYY+8wQVXqADihR+uLYbMYD0pAR40C/pRKTPAPd8D9jxecjzaL0nxsE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=URAVR1n0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="URAVR1n0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F3ABE1F0089C; Thu, 4 Jun 2026 06:39:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780555146; bh=TAekpMO3Kp6EnSvtFnl+boRFm6phDluCxfDXcPqRAVk=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=URAVR1n0jcv90Usm2ksd5MhI6S2u+eCAZPDGiHOlTZlleb6g9qZ2qc67MUNgY9EUb K44ZZH3ML+BU99vv/RBNP0osdEiSaaL56ko8HLd9nLwRyj43Vvsji7wyTVyv7c+iWx JOb16TPnMSfg8w8yl0P1qEVnoq2U+esPHOeK8wxU9nLlggkhntSaKpfDGvS0d9gWeo 86IV218W+K+4aZSyE3Z8xVq5gjxtJXXQpsc2YY10cM0Oe3NPIKtLOmVT73tmW89/ND /L1gvMPDUJdwaOAWGeW7YZBQ6EUh9BoUrOcen2TOoitrOH9Jyey0csT6eRhQsJWM0l 7KR5mSN/hYAlQ== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wV1jL-0000000AtAn-2w8u; Thu, 04 Jun 2026 08:39:03 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Paul Menzel Subject: [PATCH v4 1/5] Bluetooth: btusb: fix use-after-free on registration failure Date: Thu, 4 Jun 2026 08:37:36 +0200 Message-ID: <20260604063740.2595260-2-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260604063740.2595260-1-johan@kernel.org> References: <20260604063740.2595260-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to release the sibling interfaces in case controller registration fails to avoid use-after-free and double-free when they are eventually disconnected. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kerne= l.org Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver") Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG in= terface") Cc: stable@vger.kernel.org # 2.6.27 Reviewed-by: Paul Menzel Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 830fefb342c6..c8015cee240f 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4407,7 +4407,7 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D hci_register_dev(hdev); if (err < 0) - goto out_free_dev; + goto err_release_siblings; =20 usb_set_intfdata(intf, data); =20 @@ -4416,6 +4416,15 @@ static int btusb_probe(struct usb_interface *intf, =20 return 0; =20 +err_release_siblings: + if (data->diag) { + usb_set_intfdata(data->diag, NULL); + usb_driver_release_interface(&btusb_driver, data->diag); + } + if (data->isoc) { + usb_set_intfdata(data->isoc, NULL); + usb_driver_release_interface(&btusb_driver, data->isoc); + } out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 489E21A6831; Thu, 4 Jun 2026 06:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555148; cv=none; b=HTvHlQtp3bUTJ5OARZYV4fnpjCBDBLrv+iOgVLLBARHCHY8ytsqvSmJGiPzJjxwT9m/FFEMT5YMrib8HBRRnhFjayvEBp8zt3qw2ZT4L6BY5M983Uq2/OJVzQfskw/fFnVFGWdDKK5oo3Xr5uJEEnGlZSpk+iaRkoe1Y1hofVfM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555148; c=relaxed/simple; bh=zcn1dK/29EDlDuUjELmkDL4xNInnWxDqRDZS9QfhRPg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tlCSSdomCW+Eh7VVybby4FvXbEkR53mYiBu7b3x+fi1t8Ki+76znMY38qwOPIoerLcJl6kwS9ahvLaxkTleQjH968M0CjGAjdJvx+Qjz9Ij3Exq4cm7hFTfoduoVZlmAqE6cHlSwGmmRmG7tQ+dwbvbtFwTevTJRkaoOK8nRE74= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bHgM9mfh; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bHgM9mfh" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3A151F00893; Thu, 4 Jun 2026 06:39:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780555145; bh=fqO4LZkLQ5FT3GK1shuzVv/gvIRfqdWBmfuDHOglRjQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=bHgM9mfhC6Xz9yniMgGtgal04HmSN8XioXwkSO0xVMd2QlEAUQrLS5yaiDDrLvfQv eh0drYms6OxuJA0xfO/9CZdAIF5gan1Ys9rtH3UyKOZsiB3abNnl+FzBBUc/JbUXuT iVz+EfVpMrGlvp07l07eF4FBBw2Mu1StdS55yzO2hcB2T/yeT/zGjzDnjWS9qv+E8U g3zVh/7cLiJPE/M0SiesHuustXqI+doCYnVQ+UGM/i6jg6D2djALixBJNBJQHSVuaL Q9sLMtrtVLEU78DTHGdfGofSAFWJBMjmdLyhMzjLDbVpyoJ5JI8UaZc+BCQEA6qYPE Gy8Pm2eehWOrA== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wV1jL-0000000AtAr-2yfU; Thu, 04 Jun 2026 08:39:03 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Rajat Jain Subject: [PATCH v4 2/5] Bluetooth: btusb: fix use-after-free on marvell probe failure Date: Thu, 4 Jun 2026 08:37:37 +0200 Message-ID: <20260604063740.2595260-3-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260604063740.2595260-1-johan@kernel.org> References: <20260604063740.2595260-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to stop any TX URBs submitted during Marvell OOB wakeup configuration on later probe failures to avoid use-after-free in the completion callback. This issue was reported by Sashiko while reviewing a fix for a wakeup source leak in the btusb probe errors paths. Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kerne= l.org Fixes: a4ccc9e33d2f ("Bluetooth: btusb: Configure Marvell to use one of the= pins for oob wakeup") Cc: stable@vger.kernel.org # 4.11 Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index c8015cee240f..d0a83a1ffdf2 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4218,7 +4218,7 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_INTEL_COMBINED) { err =3D btintel_configure_setup(hdev, btusb_driver.name); if (err) - goto out_free_dev; + goto err_kill_tx_urbs; =20 /* Transport specific configuration */ hdev->send =3D btusb_send_frame_intel; @@ -4381,7 +4381,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_set_interface(data->udev, 0, 0); if (err < 0) { BT_ERR("failed to set interface 0, alt 0 %d", err); - goto out_free_dev; + goto err_kill_tx_urbs; } } =20 @@ -4389,7 +4389,7 @@ static int btusb_probe(struct usb_interface *intf, err =3D usb_driver_claim_interface(&btusb_driver, data->isoc, data); if (err < 0) - goto out_free_dev; + goto err_kill_tx_urbs; } =20 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) { @@ -4425,6 +4425,8 @@ static int btusb_probe(struct usb_interface *intf, usb_set_intfdata(data->isoc, NULL); usb_driver_release_interface(&btusb_driver, data->isoc); } +err_kill_tx_urbs: + usb_kill_anchored_urbs(&data->tx_anchor); out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48EE23C5DB8; Thu, 4 Jun 2026 06:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555148; cv=none; b=u0Ir+HeF/ik1fiN0Sub+jKjj3SX2hm8UYvf+Oof57BoNjsiHK8J0pb584qePqgRfuBKIoJItdyNn1JsAUBngUJDJYEXMvlgdxLkwbpTZzVXUcAVDE72lltYEkJ9SeDzXa8cNJItWRj3lSrmyYXEwxDQmqjYOVvQ+E4245PYcfnk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555148; c=relaxed/simple; bh=g9iLgxOtg40w0aGSmMw3jPa87HlqU0Ya5cAoV4qeXEU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LIKA0RXY746TS3u0vQpAQGEzqvFPOnXpKj1a9p7cJQs7X4GQvUaxbLehqVzM5nQZ33yk9yKtrOHlK4/7oWp1FPrVKk7l6FFIfGA6MuCr7Jk9DWxeMGqbl4/z5WLbg3wQImxG69ZOp5v1JBFDoul16VkYhAreL8LkS5nGmdFmPQs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=dbplGQwX; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="dbplGQwX" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EA40E1F0089A; Thu, 4 Jun 2026 06:39:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780555146; bh=KfkvNEfA6NZ0RTUJEBMdldhtWmqtT8xIv9nUpJq9HF8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=dbplGQwX5Ngpnt7TwlX8iV0Sb10I8A3O00fP2PiSBu1BMYUcllhzdtquzhDcBFh7C fzML5QU8AH4qhvXHuz1HlhDRarSep/V+hEwXCAGl2h7o0ILOrYaQ6OX86qrCVtl8gU 4J2RcnhajMMmFJkdaPc0u1xf7dEF9YCrMkgxm4bBdu3TTnNWE017fn3R0xAUAvKYR3 ZP9udjMT7K8ZB/BMSmkXiN5vUJD+J8EZ8Zv337XEEV2CCK8yZgu/qF4uZ01dpUC2tV 5Bcm0s6QStKYDMiQMI2TfetgCL7HAWR9eCeA72dzrB10yoWNtpens39zb9kjGJqrT/ yheVhvxAAlG/g== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wV1jL-0000000AtAu-31FB; Thu, 04 Jun 2026 08:39:03 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , stable@vger.kernel.org, Rajat Jain Subject: [PATCH v4 3/5] Bluetooth: btusb: fix wakeup source leak on probe failure Date: Thu, 4 Jun 2026 08:37:38 +0200 Message-ID: <20260604063740.2595260-4-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260604063740.2595260-1-johan@kernel.org> References: <20260604063740.2595260-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Make sure to disable wakeup on probe failure to avoid leaking the wakeup source. Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: stable@vger.kernel.org # 4.11 Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index d0a83a1ffdf2..3e8c90486e4c 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -2994,6 +2994,11 @@ static int marvell_config_oob_wake(struct hci_dev *h= dev) =20 return 0; } +#else +static inline int marvell_config_oob_wake(struct hci_dev *hdev) +{ + return 0; +} #endif =20 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev, @@ -3836,6 +3841,11 @@ static int btusb_config_oob_wake(struct hci_dev *hde= v) bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); return 0; } +#else +static inline int btusb_config_oob_wake(struct hci_dev *hdev) +{ + return 0; +} #endif =20 static void btusb_check_needs_reset_resume(struct usb_interface *intf) @@ -4172,7 +4182,6 @@ static int btusb_probe(struct usb_interface *intf, hdev->wakeup =3D btusb_wakeup; hdev->hci_drv =3D &btusb_hci_drv; =20 -#ifdef CONFIG_PM err =3D btusb_config_oob_wake(hdev); if (err) goto out_free_dev; @@ -4181,9 +4190,9 @@ static int btusb_probe(struct usb_interface *intf, if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { err =3D marvell_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_disable_wakeup; } -#endif + if (id->driver_info & BTUSB_CW6622) hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY); =20 @@ -4427,6 +4436,9 @@ static int btusb_probe(struct usb_interface *intf, } err_kill_tx_urbs: usb_kill_anchored_urbs(&data->tx_anchor); +err_disable_wakeup: + if (data->oob_wake_irq) + device_init_wakeup(&data->udev->dev, false); out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48A521C84DC; Thu, 4 Jun 2026 06:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555147; cv=none; b=pfgd9udmgYRVoiL8v/yMURWLzUUSh+pkQl4p88wVrPO6Rd5IWtpuaa11KXiHH2RojmnjKVIQFOvBuML6b7sB+HTR0eJ/ACoCo8D/yMY6lHGoaxX0DK0krNzig6625kGqfFh2bEbC5C3jTLL/El476r2qhQdRRlY/VGwk0aTOomw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555147; c=relaxed/simple; bh=vtDmusNrMao4Z6mwciC/lR4yLnLetYiSKLwA6yespiM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XMY6swkjJA7Uxlk6+wRju/Lqwwj7PLIW/9modKSSNeB8gE65vc0fXVf4onyhtcs304OC5HL3kv155vrb1ufIC9TyKBE/cH0p+v5GpNH0U8531D70FTbi6+o5oRF95MO2in0bLexv7LuMI368PvhJyOQxYMpXL5VFbp+boYSEAQI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JbiPzgIp; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JbiPzgIp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC80A1F0089B; Thu, 4 Jun 2026 06:39:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780555146; bh=ejOOzNwpl1mrjW2fyUd7AnjG9O0q5KxuZVO+r1xM+sM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=JbiPzgIpi2kk8l6/35uIfMNHPeZp+4o0yUPzYfTM61jOv5abVNYjdEz8ESBLjax3k 1CTh6sf2j7jhe6n0xT1YaJclCdOKzxQ4X4sEbu7+FI8FfXOLQzh06hftG3vVYVfHIL wDL+N9t3Z0k2osJ4qPbr7kQgMmsGXNuVZuJAnf2NJnBGRrSYIWa8UcLXzel790PnOS 3qoIz7p5BM2s+5OJ8TcAARGQOGRBHfEDg/WZRqgHUwOPlttTInCuL2ZXG7kLffHGTt mCk1yL19RkxShjtmCCRv1O3r+NUJmQ5O6pbjBFfi7e7qFqrfPj6qbfW5Yvp92YyrfD f/eo+Tpo1eLCw== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wV1jL-0000000AtAx-33Zy; Thu, 04 Jun 2026 08:39:03 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold , Rajat Jain Subject: [PATCH v4 4/5] Bluetooth: btusb: fix wakeup irq devres lifetime Date: Thu, 4 Jun 2026 08:37:39 +0200 Message-ID: <20260604063740.2595260-5-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260604063740.2595260-1-johan@kernel.org> References: <20260604063740.2595260-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The OOB wakeup interrupt is device managed but its lifetime is incorrectly tied to the child HCI device rather than the USB interface to which the driver is bound. This should not cause any trouble currently as the interrupt will be disabled when the HCI device is deregistered on disconnect (but this was not always the case, see [1]), and there should be no further references if probe fails before registering it. But it is still technically wrong as the reference counted HCI device could in theory remain after a probe failure. Explicitly free the interrupt on disconnect so that it is guaranteed to be disabled before freeing the (non-managed) driver data (including if disconnected while suspended). [1] 699fb50d9903 ("drivers: base: Free devm resources when unregistering a device") Fixes: fd913ef7ce61 ("Bluetooth: btusb: Add out-of-band wakeup support") Cc: Rajat Jain Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 3e8c90486e4c..9d2e5a8dcf85 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -3824,8 +3824,7 @@ static int btusb_config_oob_wake(struct hci_dev *hdev) } =20 irq_set_status_flags(irq, IRQ_NOAUTOEN); - ret =3D devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, - 0, "OOB Wake-on-BT", data); + ret =3D request_irq(irq, btusb_oob_wake_handler, 0, "OOB Wake-on-BT", dat= a); if (ret) { bt_dev_err(hdev, "%s: IRQ request failed", __func__); return ret; @@ -3834,12 +3833,18 @@ static int btusb_config_oob_wake(struct hci_dev *hd= ev) ret =3D device_init_wakeup(dev, true); if (ret) { bt_dev_err(hdev, "%s: failed to init_wakeup", __func__); - return ret; + goto err_free_irq; } =20 data->oob_wake_irq =3D irq; bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); + return 0; + +err_free_irq: + free_irq(irq, data); + + return ret; } #else static inline int btusb_config_oob_wake(struct hci_dev *hdev) @@ -4437,8 +4442,10 @@ static int btusb_probe(struct usb_interface *intf, err_kill_tx_urbs: usb_kill_anchored_urbs(&data->tx_anchor); err_disable_wakeup: - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } out_free_dev: if (data->reset_gpio) gpiod_put(data->reset_gpio); @@ -4471,8 +4478,11 @@ static void btusb_disconnect(struct usb_interface *i= ntf) =20 hci_unregister_dev(hdev); =20 - if (data->oob_wake_irq) + if (data->oob_wake_irq) { device_init_wakeup(&data->udev->dev, false); + free_irq(data->oob_wake_irq, data); + } + if (data->reset_gpio) gpiod_put(data->reset_gpio); =20 --=20 2.53.0 From nobody Mon Jun 8 08:35:27 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 48F633C9438; Thu, 4 Jun 2026 06:39:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555147; cv=none; b=fpF0iNiBQyy785L9/JD+4FJXtQXWN1XVw91oldAXcZMP3iNV/MwrwxuVRM0Is9ezqrFXwP97Yp54E7tgl29vgvOiZNdcW+jlfC3SypXGUzNve159d/KH567MpxElnckJflAeLYOMZRPiGweFNchukdGTSAIe9m8hZ9SCCHclVQE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780555147; c=relaxed/simple; bh=Q3kfYZcW46bIW2qT9/sECH6OUd2HM8vIk9lN8nGlVyw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qTYNabGzsbffrFuDdv1oStMzxyoEembPLSgEM4eY0iUu4Y7YacPKQWU2+QcAI98Q0eVEjbZkKEumE+o4G1mWS1k6hQK5CrXWmACVWdxuoTnQDp20LV6b3LLTfH051l/UQFCInxVV+HSdyouGPmo8PEibiKnQDYvqX33TZZiK49E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MuTArgOa; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MuTArgOa" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E59A51F00898; Thu, 4 Jun 2026 06:39:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1780555145; bh=WLdC8e8Fm2aLuCMzw+PgROgwxwX557EDKd0kldTccfY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MuTArgOaGxQO9WrRyEGEODVqsMU90ByCDy5piGLiX9dCztcLlse5az1k3PWXiaCzh tLTJJ8MDuy/PFqfVtHdz7K1gwLwSb7IuT8lJw55B7N2O3ChmLUyL2SJ0DXKMEh+w6R QcJ4DQFBIo6d7fktvz4v7ec8EZubDL7rKnOTY/aPpTpuKmZozqKFgFTfOiF2Wo+asF rCnhPc5RxgDk3ft/50su5NHZq6L1fd4KIvotgo4BYSfLMLVrtJeXOe4soemlUgmZko Rd/rh53xCSjfrEtYxZTS3FXULPNWOoWzQYluVMOEqdnak+0x21Ii4ca47KfTTNi4fG 8xfZanVgtzDJQ== Received: from johan by xi.lan with local (Exim 4.99.3) (envelope-from ) id 1wV1jL-0000000AtB0-35vG; Thu, 04 Jun 2026 08:39:03 +0200 From: Johan Hovold To: Luiz Augusto von Dentz , Marcel Holtmann Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Johan Hovold Subject: [PATCH v4 5/5] Bluetooth: btusb: clean up probe error handling Date: Thu, 4 Jun 2026 08:37:40 +0200 Message-ID: <20260604063740.2595260-6-johan@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260604063740.2595260-1-johan@kernel.org> References: <20260604063740.2595260-1-johan@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clean up probe error handling by using dedicated error labels with an "err" prefix. Note that the endpoint lookup helper returns -ENXIO when endpoints are missing which is functionally equivalent to returning -ENODEV. Signed-off-by: Johan Hovold --- drivers/bluetooth/btusb.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 9d2e5a8dcf85..b91966ec914f 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -4100,10 +4100,8 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D usb_find_common_endpoints(intf->cur_altsetting, &data->bulk_rx_ep, &data->bulk_tx_ep, &data->intr_ep, NULL); - if (err) { - kfree(data); - return -ENODEV; - } + if (err) + goto err_free_data; =20 if (id->driver_info & BTUSB_AMP) { data->cmdreq_type =3D USB_TYPE_CLASS | 0x01; @@ -4159,8 +4157,8 @@ static int btusb_probe(struct usb_interface *intf, =20 hdev =3D hci_alloc_dev_priv(priv_size); if (!hdev) { - kfree(data); - return -ENOMEM; + err =3D -ENOMEM; + goto err_free_data; } =20 hdev->bus =3D HCI_USB; @@ -4174,7 +4172,7 @@ static int btusb_probe(struct usb_interface *intf, GPIOD_OUT_LOW); if (IS_ERR(reset_gpio)) { err =3D PTR_ERR(reset_gpio); - goto out_free_dev; + goto err_free_hdev; } else if (reset_gpio) { data->reset_gpio =3D reset_gpio; } @@ -4189,7 +4187,7 @@ static int btusb_probe(struct usb_interface *intf, =20 err =3D btusb_config_oob_wake(hdev); if (err) - goto out_free_dev; + goto err_put_reset; =20 /* Marvell devices may need a specific chip configuration */ if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { @@ -4446,11 +4444,14 @@ static int btusb_probe(struct usb_interface *intf, device_init_wakeup(&data->udev->dev, false); free_irq(data->oob_wake_irq, data); } -out_free_dev: +err_put_reset: if (data->reset_gpio) gpiod_put(data->reset_gpio); +err_free_hdev: hci_free_dev(hdev); +err_free_data: kfree(data); + return err; } =20 --=20 2.53.0