diff options
| author |   Dan Carpenter <dan.carpenter@linaro.org> | 2025-04-02 14:01:41 +0300 |
|---|---|---|
| committer |   Luiz Augusto von Dentz <luiz.von.dentz@intel.com> | 2025-04-10 13:09:16 -0400 |
| commit | 324dddea321078a6eeb535c2bff5257be74c9799 (patch) | |
| tree | bea03ec25713c16a3929c292b508c7afaeaa541f /drivers/bluetooth | |
| parent | Bluetooth: hci_event: Fix sending MGMT_EV_DEVICE_FOUND for invalid address (diff) | |
| download | linux-rng-324dddea321078a6eeb535c2bff5257be74c9799.tar.xz linux-rng-324dddea321078a6eeb535c2bff5257be74c9799.zip | |
Bluetooth: btrtl: Prevent potential NULL dereference
The btrtl_initialize() function checks that rtl_load_file() either
had an error or it loaded a zero length file. However, if it loaded
a zero length file then the error code is not set correctly. It
results in an error pointer vs NULL bug, followed by a NULL pointer
dereference. This was detected by Smatch:
drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'
Fixes: 26503ad25de8 ("Bluetooth: btrtl: split the device initialization into smaller parts")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Diffstat (limited to 'drivers/bluetooth')
| -rw-r--r-- | drivers/bluetooth/btrtl.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c index d3eba0d4a57d..7838c89e529e 100644 --- a/drivers/bluetooth/btrtl.c +++ b/drivers/bluetooth/btrtl.c @@ -1215,6 +1215,8 @@ next: rtl_dev_err(hdev, "mandatory config file %s not found", btrtl_dev->ic_info->cfg_name); ret = btrtl_dev->cfg_len; + if (!ret) + ret = -EINVAL; goto err_free; } } |