[PATCH] Bluetooth: btintel_pcie: Fix DMA memory leak on probe failure

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>

In btintel_pcie_probe(), when btintel_pcie_alloc() succeeds but a
later step (btintel_pcie_enable_bt, btintel_pcie_start_rx, or
btintel_pcie_setup_hdev) fails, the DMA buffers and descriptors
allocated by btintel_pcie_alloc() are not freed. The exit_error
path only resets the device and destroys workqueues, causing a
DMA memory leak.

Fix this by introducing an exit_error_free label that calls
btintel_pcie_free(data) to release all DMA buffers and the DMA
pool before proceeding to the common exit_error path. Error paths
after successful allocation jump to exit_error_free, while the
allocation failure itself (which is already cleaned up internally
by btintel_pcie_alloc) jumps directly to exit_error.

Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
Signed-off-by: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>
---
 drivers/bluetooth/btintel_pcie.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
index 9e39327dc1fe..b672ce376e9d 100644
--- a/drivers/bluetooth/btintel_pcie.c
+++ b/drivers/bluetooth/btintel_pcie.c
@@ -2896,7 +2896,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	err = btintel_pcie_enable_bt(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	/* CNV information (CNVi and CNVr) is in CSR */
 	data->cnvi = btintel_pcie_rd_reg32(data, BTINTEL_PCIE_CSR_HW_REV_REG);
@@ -2905,16 +2905,20 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
 
 	err = btintel_pcie_start_rx(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	err = btintel_pcie_setup_hdev(data);
 	if (err)
-		goto exit_error;
+		goto exit_error_free;
 
 	bt_dev_dbg(data->hdev, "cnvi: 0x%8.8x cnvr: 0x%8.8x", data->cnvi,
 		   data->cnvr);
 	return 0;
 
+exit_error_free:
+	/* Free DMA buffers and descriptors allocated in btintel_pcie_alloc() */
+	btintel_pcie_free(data);
+
 exit_error:
 	/* reset device before exit */
 	btintel_pcie_reset_bt(data);
-- 
2.25.1