]> git.ipfire.org Git - thirdparty/linux.git/commit
Bluetooth: btusb: fix use-after-free on registration failure
authorJohan Hovold <johan@kernel.org>
Thu, 4 Jun 2026 06:37:36 +0000 (08:37 +0200)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Thu, 11 Jun 2026 18:24:40 +0000 (14:24 -0400)
commiteedc6867ebad73edbfaf9a0a65fbef7115cc4753
treed2867d361529994366880804b50a471d21450858
parentf396f4005180928cd9e15e352a6512865d3bc908
Bluetooth: btusb: fix use-after-free on registration failure

Make sure to release the sibling interfaces in case controller
registration fails to avoid use-after-free and double-free when they are
eventually disconnected.

This issue was reported by Sashiko while reviewing a fix for a wakeup
source leak in the btusb probe errors paths.

Link: https://sashiko.dev/#/patchset/20260402092704.2346710-1-johan%40kernel.org
Fixes: 9bfa35fe422c ("[Bluetooth] Add SCO support to btusb driver")
Fixes: 9d08f50401ac ("Bluetooth: btusb: Add support for Broadcom LM_DIAG interface")
Cc: stable@vger.kernel.org # 2.6.27
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
drivers/bluetooth/btusb.c