Re: [PATCH] Bluetooth: btintel_pcie: fix memory leak in btintel_pcie_probe()

[Paul Menzel]

Dear Abdun,


Welcome, and thank you for your patch.

Am 10.07.26 um 08:03 schrieb Abdun Nihaal:
> The memory allocated for data->workqueue is not free in some of the

free*d*

> error paths. Fix that by adding the corresponding free function.
>
> Fixes: c2b636b3f788 ("Bluetooth: btintel_pcie: Add support for PCIe transport")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Abdun Nihaal <nihaal@xxxxxxxxxxxxxx>
> ---
> Compile tested only. Issue found using static analysis.

Maybe add that to the commit message, and the mention the tool you used.

>   drivers/bluetooth/btintel_pcie.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/bluetooth/btintel_pcie.c b/drivers/bluetooth/btintel_pcie.c
> index 7a87549f587d..870939d8450b 100644
> --- a/drivers/bluetooth/btintel_pcie.c
> +++ b/drivers/bluetooth/btintel_pcie.c
> @@ -2988,6 +2988,7 @@ static int btintel_pcie_probe(struct pci_dev *pdev,
>   	btintel_pcie_reset_bt(data);
>   
>   	destroy_workqueue(data->dump_workqueue);
> +	destroy_workqueue(data->workqueue);

gemini/gemini-3.1-pro-preview comments [1]:

> Is there a use-after-free race condition introduced here? 
> If the workqueue is destroyed while the devm-managed IRQ handler is still
> active, could an inbound device interrupt arrive before devres tears down the
> handlers? This would route to the active handler and execute queue_work()
> against the destroyed workqueue memory.


>   
>   	pci_clear_master(pdev);


Kind regards,

Paul


[1]: 
https://sashiko.dev/#/patchset/20260710060334.136987-1-nihaal%40cse.iitm.ac.in