[PATCH v5] Bluetooth: fix memory leak in error path of hci_alloc_dev()

[PATCH v5] Bluetooth: fix memory leak in error path of hci_alloc_dev()

[Bharath Reddy]

Early failures in Bluetooth HCI UART configuration leak SRCU percpu
memory.

When device initialization fails before hci_register_dev() completes,
the HCI_UNREGISTER flag is never set. As a result, when the device
reference count reaches zero, bt_host_release() evaluates this flag as
false and falls back to a direct kfree(hdev).

Because hci_release_dev() is bypassed, the SRCU struct initialized
early in hci_alloc_dev() is never cleaned up, resulting in a leak of
percpu memory.

Fix the leak by explicitly calling cleanup_srcu_struct() in the
fallback (unregistered) branch of bt_host_release() before freeing
the device.

Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=535ecc844591e50588a5
Tested-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Fixes: 1d6123102e9f ("Bluetooth: hci_core: Fix use-after-free in vhci_flush()")
Signed-off-by: Bharath Reddy <kbreddy.rpbc@gmail.com>
---
Changes in v5:
 - Removed trailing whitespace in the version history to fix GitLint error

Changes in v4:
 - Included patch version history

Changes in v3:
 - Added missing curly braces to the if/else block in bt_host_release()
   to resolve a checkpatch.pl warning
 - Added Fixes and Closes tags

Changes in v2:
 - Fixed a NULL pointer dereference caused by v1
 - Moved cleanup_srcu_struct() to the fallback (unregistered) branch
   of bt_host_release() instead of unconditionally calling hci_release_dev()

Changes in v1:
- Initial patch (failed because it bypassed the HCI_UNREGISTER check)

 net/bluetooth/hci_sysfs.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 041ce9adc378..8957ce7c21b7 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -83,10 +83,12 @@ static void bt_host_release(struct device *dev)
 {
 	struct hci_dev *hdev = to_hci_dev(dev);
 
-	if (hci_dev_test_flag(hdev, HCI_UNREGISTER))
+	if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
 		hci_release_dev(hdev);
-	else
+	} else {
+		cleanup_srcu_struct(&hdev->srcu);
 		kfree(hdev);
+	}
 	module_put(THIS_MODULE);
 }
 
-- 
2.34.1

Re: [PATCH v5] Bluetooth: fix memory leak in error path of hci_alloc_dev()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Mon,  1 Jun 2026 08:54:26 +0530 you wrote:
> Early failures in Bluetooth HCI UART configuration leak SRCU percpu
> memory.
> 
> When device initialization fails before hci_register_dev() completes,
> the HCI_UNREGISTER flag is never set. As a result, when the device
> reference count reaches zero, bt_host_release() evaluates this flag as
> false and falls back to a direct kfree(hdev).
> 
> [...]

Here is the summary with links:
  - [v5] Bluetooth: fix memory leak in error path of hci_alloc_dev()
    https://git.kernel.org/bluetooth/bluetooth-next/c/cf767a2d88f7

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html