[PATCH] Bluetooth: virtio_bt: fix memory leak in virtbt_probe

[Zhao Dongdong]

From: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>

In virtbt_probe(), the vbt structure is allocated via kzalloc_obj()
but not freed when virtio_find_vqs() fails. Additionally, the
open_failed and failed error labels do not free vbt, causing a
memory leak on any error path after vbt allocation.

Fix the leak by adding a dedicated err_find_vqs label after del_vqs
in the failed path, so that find_vqs failures skip del_vqs (since
vqs were never established) while still freeing vbt. The existing
failed and open_failed labels also gain vbt cleanup.

Fixes: afd2daa26c7a ("Bluetooth: Add support for virtio transport driver")
Signed-off-by: Zhao Dongdong <zhaodongdong@xxxxxxxxxx>
---
 drivers/bluetooth/virtio_bt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/virtio_bt.c b/drivers/bluetooth/virtio_bt.c
index 140ab55c9fc5..61ab3863bb0f 100644
--- a/drivers/bluetooth/virtio_bt.c
+++ b/drivers/bluetooth/virtio_bt.c
@@ -311,7 +311,7 @@ static int virtbt_probe(struct virtio_device *vdev)
 
 	err = virtio_find_vqs(vdev, VIRTBT_NUM_VQS, vbt->vqs, vqs_info, NULL);
 	if (err)
-		return err;
+		goto find_vqs_failed;
 
 	hdev = hci_alloc_dev();
 	if (!hdev) {
@@ -400,6 +400,9 @@ static int virtbt_probe(struct virtio_device *vdev)
 	hci_free_dev(hdev);
 failed:
 	vdev->config->del_vqs(vdev);
+find_vqs_failed:
+	vdev->priv = NULL;
+	kfree(vbt);
 	return err;
 }
 
-- 
2.25.1