[PATCH] Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()

[PATCH] Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()

[Charles Han]

devm_kstrdup() can return a NULL pointer on failure,but this
returned value in btbcm_get_board_name() is not checked.
Add NULL check in btbcm_get_board_name(), to handle kernel NULL
pointer dereference error.

Fixes: f9183eaad915 ("Bluetooth: btbcm: Use devm_kstrdup()")
Signed-off-by: Charles Han <hanchunchao@inspur.com>
---
 drivers/bluetooth/btbcm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
index a1153ada74d2..d7f3ccf5f594 100644
--- a/drivers/bluetooth/btbcm.c
+++ b/drivers/bluetooth/btbcm.c
@@ -553,6 +553,9 @@ static const char *btbcm_get_board_name(struct device *dev)
 
 	/* get rid of any '/' in the compatible string */
 	board_type = devm_kstrdup(dev, tmp, GFP_KERNEL);
+	if (!board_type)
+		return -ENOMEM;
+
 	strreplace(board_type, '/', '-');
 
 	return board_type;
-- 
2.31.1

RE: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 2904 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=921080

---Test result---

Test Summary:
CheckPatch                    PENDING   0.36 seconds
GitLint                       PENDING   0.26 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      25.36 seconds
CheckAllWarning               WARNING   27.46 seconds
CheckSparse                   WARNING   30.97 seconds
BuildKernel32                 PASS      24.72 seconds
TestRunnerSetup               PASS      440.96 seconds
TestRunner_l2cap-tester       PASS      20.57 seconds
TestRunner_iso-tester         PASS      32.53 seconds
TestRunner_bnep-tester        PASS      4.89 seconds
TestRunner_mgmt-tester        FAIL      121.19 seconds
TestRunner_rfcomm-tester      PASS      7.72 seconds
TestRunner_sco-tester         PASS      9.46 seconds
TestRunner_ioctl-tester       PASS      8.60 seconds
TestRunner_mesh-tester        PASS      6.13 seconds
TestRunner_smp-tester         PASS      7.13 seconds
TestRunner_userchan-tester    PASS      5.11 seconds
IncrementalBuild              PENDING   0.95 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: CheckAllWarning - WARNING
Desc: Run linux kernel with all warning enabled
Output:
drivers/bluetooth/btbcm.c: In function ‘btbcm_get_board_name’:drivers/bluetooth/btbcm.c:557:10: warning: returning ‘int’ from a function with return type ‘const char *’ makes pointer from integer without a cast [-Wint-conversion]  557 |   return -ENOMEM;      |          ^
##############################
Test: CheckSparse - WARNING
Desc: Run sparse tool with linux kernel
Output:
drivers/bluetooth/btbcm.c: In function ‘btbcm_get_board_name’:drivers/bluetooth/btbcm.c:557:10: warning: returning ‘int’ from a function with return type ‘const char *’ makes pointer from integer without a cast [-Wint-conversion]drivers/bluetooth/btbcm.c:557:24: warning: incorrect type in return expression (different base types)drivers/bluetooth/btbcm.c:557:24:    expected char const *drivers/bluetooth/btbcm.c:557:24:    got int
##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 485 (99.0%), Failed: 1, Not Run: 4

Failed Test Cases
LL Privacy - Start Discovery 2 (Disable RL)          Failed       0.179 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Fri, 27 Dec 2024 17:20:46 +0800 you wrote:
> devm_kstrdup() can return a NULL pointer on failure,but this
> returned value in btbcm_get_board_name() is not checked.
> Add NULL check in btbcm_get_board_name(), to handle kernel NULL
> pointer dereference error.
> 
> Fixes: f9183eaad915 ("Bluetooth: btbcm: Use devm_kstrdup()")
> Signed-off-by: Charles Han <hanchunchao@inspur.com>
> 
> [...]

Here is the summary with links:
  - Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
    https://git.kernel.org/bluetooth/bluetooth-next/c/52d2af107592

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html