Bluetooth: virtio_bt: harden probe error paths

From: Yi Cong <[email protected]>

This small series hardens the two error paths in virtbt_probe() that currently leak or leave dangling state behind:

1/2 - if virtio_find_vqs() fails, the allocated 'vbt' and the

        'vdev->priv' pointer that already references it are leaked.

2/2 - if virtbt_open_vdev() fails after hci_register_dev() has
succeeded, the hdev is freed without unregistering, leaving a dangling entry in the global HCI device list (UAF).

Yi Cong (2):
Bluetooth: virtio_bt: fix leak of vbt on virtio_find_vqs failure
Bluetooth: virtio_bt: unregister hdev before freeing on open failure

 drivers/bluetooth/virtio_bt.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

2.25.1

From: Yi Cong <[email protected]>

If virtio_find_vqs() fails, the function returns without freeing the allocated 'vbt' or clearing 'vdev->priv'. Add a 'free_priv' label to release them, and let 'failed' fall through to it.

---
 drivers/bluetooth/virtio_bt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

index c20d54088c8c4..b674fe0c2779e 100644
@@ -315,7 +315,7 @@ static int virtbt_probe(struct virtio_device *vdev)
 
 	err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
 	if (err)
-		return err;
+		goto free_priv;
 
 	hdev = hci_alloc_dev();
 	if (!hdev) {

@@ -404,6 +404,9 @@ static int virtbt_probe(struct virtio_device *vdev)
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);
+free_priv:
+	vdev->priv = NULL;
+	kfree(vbt);
 	return err;
 }
 

2.25.1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list. This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1143771

---Test result---

Test Summary:

CheckPatch                    PASS      1.03 seconds
VerifyFixes                   PASS      0.06 seconds
VerifySignedoff               PASS      0.06 seconds
GitLint                       PASS      0.39 seconds
SubjectPrefix                 PASS      0.11 seconds
BuildKernel                   PASS      27.54 seconds
CheckAllWarning               PASS      30.76 seconds
CheckSparse                   PASS      28.75 seconds
BuildKernel32                 PASS      26.32 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      507.05 seconds
IncrementalBuild              PASS      27.24 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found

https://github.com/bluez/bluetooth-next/pull/568

---
Regards,
Linux Bluetooth

From: Yi Cong <[email protected]>

When virtbt_open_vdev() fails after hci_register_dev() has succeeded, the 'open_failed' path frees the hdev without unregistering it first, leaving a dangling entry in the global HCI device list.

---
 drivers/bluetooth/virtio_bt.c | 1 +
 1 file changed, 1 insertion(+)

index b674fe0c2779e..7c9c3f0085dc0 100644
@@ -401,6 +401,7 @@ static int virtbt_probe(struct virtio_device *vdev)
 	return 0;
 
 open_failed:
+	hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);

2.25.1