Johan Hovold eedc6867eb Bluetooth: btusb: fix use-after-free on registration failure ...

Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.

Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: 9bfa35fe42 ("[Bluetooth] Add SCO support to btusb driver")
Fixes: 9d08f50401 ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
Cc: stable@vger.kernel.org	# 2.6.27
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

2026-06-11 14:24:40 -04:00

..

ath3k.c

move asm/unaligned.h to linux/unaligned.h

2024-10-02 17:23:23 -04:00

bcm203x.c

Bluetooth: bcm203x: remove superfluous header files

2022-03-18 17:12:09 +01:00

bfusb.c

Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap

2025-07-16 15:37:53 -04:00

bpa10x.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

btbcm.c

Bluetooth: btbcm: Add entry for BCM4343A2 UART Bluetooth

2026-04-10 10:22:21 -04:00

btbcm.h

Bluetooth: hci_bcm: Add support for FW loading in autobaud mode

2022-07-21 17:04:38 -07:00

btintel_pcie.c

Bluetooth: btintel_pcie: Support Product level reset

2026-06-11 14:24:37 -04:00

btintel_pcie.h

Bluetooth: btintel_pcie: Support Product level reset

2026-06-11 14:24:37 -04:00

btintel.c

Bluetooth: btintel_pcie: Support Product level reset

2026-06-11 14:24:37 -04:00

btintel.h

Bluetooth: btintel_pcie: Support Product level reset

2026-06-11 14:24:37 -04:00

btmrvl_debugfs.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

btmrvl_drv.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE

2022-06-10 14:51:36 +02:00

btmrvl_main.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

btmrvl_sdio.c

Bluetooth: btmrvl_sdio: Fix wakeup source leaks on device unbind

2025-05-21 10:27:20 -04:00

btmrvl_sdio.h

treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_390.RULE

2022-06-10 14:51:36 +02:00

btmtk.c

Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path

2026-06-11 14:24:40 -04:00

btmtk.h

Bluetooth: btmtk: add event filter to filter specific event

2026-06-11 14:24:37 -04:00

btmtksdio.c

Bluetooth: btmtk: Add MT6639 (MT7927) Bluetooth support

2026-04-13 09:18:16 -04:00

btmtkuart.c

Bluetooth: fix corruption in h4_recv_buf() after cleanup

2025-10-24 10:31:24 -04:00

btnxpuart.c

Bluetooth: btnxpuart: Remove unneeded CONFIG_PM ifdef

2026-01-29 13:34:25 -05:00

btqca.c

Bluetooth: qca: Refactor code on the basis of chipset names

2026-04-10 10:22:00 -04:00

btqca.h

Bluetooth: qca: add WCN3950 support

2025-03-25 12:42:35 -04:00

btqcomsmd.c

Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap

2025-07-16 15:37:53 -04:00

btrsi.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

btrtl.c

Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan

2026-06-11 14:24:38 -04:00

btrtl.h

Bluetooth: btrtl: Add Realtek devcoredump support

2023-08-11 11:35:14 -07:00

btsdio.c

Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap

2025-07-16 15:37:53 -04:00

btusb.c

Bluetooth: btusb: fix use-after-free on registration failure

2026-06-11 14:24:40 -04:00

hci_ag6xx.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_aml.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_ath.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_bcm4377.c

Bluetooth: hci_bcm4377: Use generic power management

2026-01-29 13:22:42 -05:00

hci_bcm.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_bcsp.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_h4.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_h5.c

Bluetooth: hci_uart: Fix NULL deref in recv callbacks when priv is uninitialized

2026-05-06 16:21:43 -04:00

hci_intel.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_ldisc.c

Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

2026-05-20 16:35:47 -04:00

hci_ll.c

Bluetooth: hci_ll: Enable BROKEN_ENHANCED_SETUP_SYNC_CONN for WL183x

2026-04-13 09:19:42 -04:00

hci_mrvl.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

hci_nokia.c

Bluetooth: fix corruption in h4_recv_buf() after cleanup

2025-10-24 10:31:24 -04:00

hci_qca.c

Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device

2026-06-11 14:24:39 -04:00

hci_serdev.c

Bluetooth: hci_dev: replace 'quirks' integer by 'quirk_flags' bitmap

2025-07-16 15:37:53 -04:00

hci_uart.h

Bluetooth: fix corruption in h4_recv_buf() after cleanup

2025-10-24 10:31:24 -04:00

hci_vhci.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

Kconfig

bluetooth: remove all PCMCIA drivers

2026-06-11 14:24:38 -04:00

Makefile

bluetooth: remove all PCMCIA drivers

2026-06-11 14:24:38 -04:00

virtio_bt.c

Bluetooth: virtio_bt: validate rx pkt_type header length

2026-05-06 16:22:33 -04:00