mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-22 03:27:30 -04:00
Code Issues Packages Projects Releases Wiki Activity

Bluetooth: btusb: fix use-after-free on registration failure

Browse Source 
Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.

Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: 9bfa35fe42 ("[Bluetooth] Add SCO support to btusb driver")
Fixes: 9d08f50401 ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
Cc: stable@vger.kernel.org	# 2.6.27
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
This commit is contained in:
Johan Hovold
2026-06-04 08:37:36 +02:00
committed by Luiz Augusto von Dentz
parent f396f40051
commit eedc6867eb
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/bluetooth/btusb.c
View File

@@ -4427,7 +4427,7 @@ static int btusb_probe(struct usb_interface *intf,
err = hci_register_dev(hdev);
if (err < 0)
goto out_free_dev;
goto err_release_siblings;
usb_set_intfdata(intf, data);
@@ -4436,6 +4436,15 @@ static int btusb_probe(struct usb_interface *intf,
return 0;
err_release_siblings:
if (data->diag) {
usb_set_intfdata(data->diag, NULL);
usb_driver_release_interface(&btusb_driver, data->diag);
}
if (data->isoc) {
usb_set_intfdata(data->isoc, NULL);
usb_driver_release_interface(&btusb_driver, data->isoc);
}
out_free_dev:
if (data->reset_gpio)
gpiod_put(data->reset_gpio);