[v1] Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

[PATCH] Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

Posted by Zhao Dongdong 1 week, 5 days ago

From: Zhao Dongdong <zhaodongdong@kylinos.cn>

In btintel_pcie_probe(), when btintel_pcie_alloc() succeeds but a
later step (btintel_pcie_enable_bt, btintel_pcie_start_rx, or
btintel_pcie_setup_hdev) fails, the DMA buffers and descriptors
allocated by btintel_pcie_alloc() are not freed. The exit_error
path only resets the device and destroys workqueues, causing a
DMA memory leak.

Fix this by introducing an exit_error_free label that calls
btintel_pcie_free(data) to release all DMA buffers and the DMA
pool before proceeding to the common exit_error path. Error paths
after successful allocation jump to exit_error_free, while the
allocation failure itself (which is already cleaned up internally
by btintel_pcie_alloc) jumps directly to exit_error.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
---
 drivers/bluetooth/btintel_pcie.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 9e39327dc1fe..b672ce376e9d 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2896,7 +2896,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	err = btintel_pcie_enable_bt(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	/* CNV information (CNVi and CNVr) is in CSR */
 	data->cnvi = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_HW_REV_REG);
@@ -2905,16 +2905,20 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	err = btintel_pcie_start_rx(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	err = btintel_pcie_setup_hdev(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	bt_dev_dbg(data->hdev, "cnvi: 0x%8.8x cnvr: 0x%8.8x", data->cnvi,
 		   data->cnvr);
 	return 0;
 
+exit_error_free:
+	/* Free DMA buffers and descriptors allocated in btintel_pcie_alloc() */
+	btintel_pcie_free(data);
+
 exit_error:
 	/* reset device before exit */
 	btintel_pcie_reset_bt(data);
-- 
2.25.1

Re: [PATCH] Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

Posted by Luiz Augusto von Dentz 1 week, 5 days ago

Hi Zhao,

On Mon, Jul 13, 2026 at 6:38 AM Zhao Dongdong <winter91@foxmail.com> wrote:
>
> From: Zhao Dongdong <zhaodongdong@kylinos.cn>
>
> In btintel_pcie_probe(), when btintel_pcie_alloc() succeeds but a
> later step (btintel_pcie_enable_bt, btintel_pcie_start_rx, or
> btintel_pcie_setup_hdev) fails, the DMA buffers and descriptors
> allocated by btintel_pcie_alloc() are not freed. The exit_error
> path only resets the device and destroys workqueues, causing a
> DMA memory leak.
>
> Fix this by introducing an exit_error_free label that calls
> btintel_pcie_free(data) to release all DMA buffers and the DMA
> pool before proceeding to the common exit_error path. Error paths
> after successful allocation jump to exit_error_free, while the
> allocation failure itself (which is already cleaned up internally
> by btintel_pcie_alloc) jumps directly to exit_error.
>
> Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
> Signed-off-by: Zhao Dongdong <zhaodongdong@kylinos.cn>
> ---
>  drivers/bluetooth/btintel_pcie.c | 10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 9e39327dc1fe..b672ce376e9d 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -2896,7 +2896,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
>
>         err = btintel_pcie_enable_bt(data);
>         if (err)
> -               goto exit_error;
> +               goto exit_error_free;
>
>         /* CNV information (CNVi and CNVr) is in CSR */
>         data->cnvi = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_HW_REV_REG);
> @@ -2905,16 +2905,20 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
>
>         err = btintel_pcie_start_rx(data);
>         if (err)
> -               goto exit_error;
> +               goto exit_error_free;
>
>         err = btintel_pcie_setup_hdev(data);
>         if (err)
> -               goto exit_error;
> +               goto exit_error_free;
>
>         bt_dev_dbg(data->hdev, "cnvi: 0x%8.8x cnvr: 0x%8.8x", data->cnvi,
>                    data->cnvr);
>         return 0;
>
> +exit_error_free:
> +       /* Free DMA buffers and descriptors allocated in btintel_pcie_alloc() */
> +       btintel_pcie_free(data);
> +
>  exit_error:
>         /* reset device before exit */
>         btintel_pcie_reset_bt(data);
> --
> 2.25.1

Sashiko seem to have found a problem with this change:

https://sashiko.dev/#/patchset/tencent_44ED865C14DA3D3823CA85AE1DF2CEBC1805%40qq.com

-- 
Luiz Augusto von Dentz