Re: [PATCH] Bluetooth: virtio_bt: Fix use-after-free and memory leak in probe error paths

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Tue, 11 Aug 2026 16:47:37 +0800 you wrote:
> When virtbt_open_vdev() fails in virtbt_probe(), hci_free_dev(hdev) is
> called without first calling hci_unregister_dev(hdev). Since
> hci_register_dev() already succeeded, the HCI device remains registered
> while its memory is freed, leading to a use-after-free when accessed
> via sysfs or HCI sockets.
> 
> Additionally, the probe function leaks the virtio_bluetooth structure
> (vbt) in several error paths:
>   - When virtio_find_vqs() fails, vbt is not freed.
>   - When hci_alloc_dev() or hci_register_dev() fails, vbt is not freed.
>   - When virtbt_open_vdev() fails, vbt is not freed.
> 
> [...]

Here is the summary with links:
  - Bluetooth: virtio_bt: Fix use-after-free and memory leak in probe error paths
    https://git.kernel.org/bluetooth/bluetooth-next/c/444612a87229

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html