| Message ID | 0174d93d-f3a5-48ed-a755-ed7f6455c1bf@stanley.mountain |
|---|---|
| State | New |
| Headers | show |
| Series | Bluetooth: btrtl: Prevent potential NULL dereference | expand |
Hello: This patch was applied to bluetooth/bluetooth-next.git (master) by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>: On Wed, 2 Apr 2025 14:01:41 +0300 you wrote: > The btrtl_initialize() function checks that rtl_load_file() either > had an error or it loaded a zero length file. However, if it loaded > a zero length file then the error code is not set correctly. It > results in an error pointer vs NULL bug, followed by a NULL pointer > dereference. This was detected by Smatch: > > drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' > > [...] Here is the summary with links: - Bluetooth: btrtl: Prevent potential NULL dereference https://git.kernel.org/bluetooth/bluetooth-next/c/113f1345ce0c You are awesome, thank you!
diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c index d3eba0d4a57d..7838c89e529e 100644 --- a/drivers/bluetooth/btrtl.c +++ b/drivers/bluetooth/btrtl.c @@ -1215,6 +1215,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, rtl_dev_err(hdev, "mandatory config file %s not found", btrtl_dev->ic_info->cfg_name); ret = btrtl_dev->cfg_len; + if (!ret) + ret = -EINVAL; goto err_free; } }
The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch: drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' Fixes: 26503ad25de8 ("Bluetooth: btrtl: split the device initialization into smaller parts") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/bluetooth/btrtl.c | 2 ++ 1 file changed, 2 insertions(+)