[PATCH] Bluetooth: virtio_bt: fix virtbt_probe error handling

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>

The error handling in virtbt_probe() has two issues:

1. Memory leak: vbt is allocated via kzalloc_obj() but not freed on
   the virtio_find_vqs() failure path nor the generic failed path.

2. Clean-up order on open failure: virtbt_open_vdev() failing after
   hci_register_dev() leaves the device registered and queues
   dangling. Only hci_free_dev() is called, skipping unregister,
   reset and buffer cleanup.

Fix 1: add find_vqs_failed label (after del_vqs) so that VQS
failures skip queue teardown while still freeing vbt.

Fix 2: re-open the open_failed path to mirror the remove sequence
in reverse order: virtbt_close_vdev() to drop queued buffers,
virtio_reset_device() to quiesce the device, hci_unregister_dev()
to deregister from the BT core, then hci_free_dev().

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>
---
 drivers/bluetooth/virtio_bt.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..cca7e1281740 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -311,7 +311,7 @@ static int virtbt_probe(struct virtio_device *vdev)

 	err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
 	if (err)
-		return err;
+		goto find_vqs_failed;

 	hdev = hci_alloc_dev();
 	if (!hdev) {
@@ -397,9 +397,15 @@ static int virtbt_probe(struct virtio_device *vdev)
 	return 0;

 open_failed:
+	virtbt_close_vdev(vbt);
+	virtio_reset_device(vdev);
+	hci_unregister_dev(hdev);
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);
+find_vqs_failed:
+	vdev->priv = NULL;
+	kfree(vbt);
 	return err;
 }

--
2.43.0