Re: [PATCH] Bluetooth: virtio_bt: Fix use-after-free and memory leak in probe error paths
| Newsgroups | org.kernel.vger.linux-bluetooth,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <178647902738.1134064.8343131189969253325.git-patchwork-notify@kernel.org> |
Hello: This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <[email protected]>: On Tue, 11 Aug 2026 16:47:37 +0800 you wrote: > When virtbt_open_vdev() fails in virtbt_probe(), hci_free_dev(hdev) is > called without first calling hci_unregister_dev(hdev). Since > hci_register_dev() already succeeded, the HCI device remains registered > while its memory is freed, leading to a use-after-free when accessed > via sysfs or HCI sockets. > > Additionally, the probe function leaks the virtio_bluetooth structure > (vbt) in several error paths: > - When virtio_find_vqs() fails, vbt is not freed. > - When hci_alloc_dev() or hci_register_dev() fails, vbt is not freed. > - When virtbt_open_vdev() fails, vbt is not freed. > > [...] Here is the summary with links: - Bluetooth: virtio_bt: Fix use-after-free and memory leak in probe error paths https://git.kernel.org/bluetooth/bluetooth-next/c/444612a87229 You are awesome, thank you! -- Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html