[PATCH] Bluetooth: btusb: fix USB interface release on probe error path

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>

When hci_register_dev() fails in btusb_probe(), the isochronous and
diag USB interfaces previously claimed via
usb_driver_claim_interface() are not released. This causes USB
interface reference count leakage, preventing subsequent re-probe of
the same device and leaving stale entries in /sys/kernel/debug/usb.

Add a new out_release_iface error label that releases any claimed
interfaces before falling through to out_free_dev for the remaining
cleanup. This follows the kernel's standard reverse-order cleanup
chain pattern and avoids releasing interfaces on earlier error paths
where they may not have been claimed yet.

Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver")
Signed-off-by: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>
---
 drivers/bluetooth/btusb.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 830fefb342c6..829d7dbcd84d 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4407,7 +4407,7 @@ static int btusb_probe(struct usb_interface *intf,
 
 	err = hci_register_dev(hdev);
 	if (err < 0)
-		goto out_free_dev;
+		goto out_release_iface;
 
 	usb_set_intfdata(intf, data);
 
@@ -4416,6 +4416,12 @@ static int btusb_probe(struct usb_interface *intf,
 
 	return 0;
 
+out_release_iface:
+	if (data->diag)
+		usb_driver_release_interface(&btusb_driver, data->diag);
+	if (data->isoc)
+		usb_driver_release_interface(&btusb_driver, data->isoc);
+
 out_free_dev:
 	if (data->reset_gpio)
 		gpiod_put(data->reset_gpio);
-- 
2.25.1