[PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev

[PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev

[Wentao Liang]

In btmrvl_register_hdev(), when hci_register_dev() fails, the
function frees the hci_dev via hci_free_dev() but leaves
priv->btmrvl_dev.hcidev as a dangling pointer. While the subsequent
cleanup code does not currently access it, setting it to NULL is a
defensive fix that prevents potential use-after-free.

Additionally, the function always returns -ENOMEM on the
hci_register_dev() failure path, discarding the actual error code.
Fix this by preserving and returning the original error code.

Cc: stable@vger.kernel.org
Fixes: 132ff4e5fa8d ("Bluetooth: Add btmrvl driver for Marvell Bluetooth devices")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/bluetooth/btmrvl_main.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index d6f0ad0b4b6e..3a4c8abae05b 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -683,7 +683,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 	ret = hci_register_dev(hdev);
 	if (ret < 0) {
 		BT_ERR("Can not register HCI device");
-		goto err_hci_register_dev;
+		goto err_hci_register_dev_free;
 	}
 
 #ifdef CONFIG_DEBUG_FS
@@ -692,8 +692,9 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 
 	return 0;
 
-err_hci_register_dev:
+err_hci_register_dev_free:
 	hci_free_dev(hdev);
+	priv->btmrvl_dev.hcidev = NULL;
 
 err_hdev:
 	/* Stop the thread servicing the interrupts */
@@ -702,7 +703,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 	btmrvl_free_adapter(priv);
 	kfree(priv);
 
-	return -ENOMEM;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(btmrvl_register_hdev);
 
-- 
2.39.5 (Apple Git-154)

RE: btmrvl: Fix hdev dangling pointer and error code in register_hdev

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1348 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1116653

---Test result---

Test Summary:
CheckPatch                    PASS      1.04 seconds
VerifyFixes                   PASS      0.21 seconds
VerifySignedoff               PASS      0.20 seconds
GitLint                       PASS      0.46 seconds
SubjectPrefix                 FAIL      0.20 seconds
BuildKernel                   PASS      26.32 seconds
CheckAllWarning               PASS      29.01 seconds
CheckSparse                   PASS      27.79 seconds
BuildKernel32                 PASS      25.65 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      490.64 seconds
IncrementalBuild              PASS      25.84 seconds

Details
##############################
Test: SubjectPrefix - FAIL
Desc: Check subject contains "Bluetooth" prefix
Output:
"Bluetooth: " prefix is not specified in the subject
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/353

---
Regards,
Linux Bluetooth

Re: [PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev

[kernel test robot]

Hi Wentao,

kernel test robot noticed the following build warnings:

[auto build test WARNING on bluetooth-next/master]
[also build test WARNING on bluetooth/master linus/master v7.2-rc6 next-20260807]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Wentao-Liang/btmrvl-Fix-hdev-dangling-pointer-and-error-code-in-register_hdev/20260808-022129
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
patch link:    https://lore.kernel.org/r/20260625160607.81615-1-vulab%40iscas.ac.cn
patch subject: [PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20260809/202608090403.IZoIz1yQ-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 12df34b8469b8095359de8c249cb1b2753fadeea)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260809/202608090403.IZoIz1yQ-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608090403.IZoIz1yQ-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/bluetooth/btmrvl_main.c:685:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
     685 |         if (!hdev) {
         |             ^~~~~
   drivers/bluetooth/btmrvl_main.c:726:9: note: uninitialized use occurs here
     726 |         return ret;
         |                ^~~
   drivers/bluetooth/btmrvl_main.c:685:2: note: remove the 'if' if its condition is always false
     685 |         if (!hdev) {
         |         ^~~~~~~~~~~~
     686 |                 BT_ERR("Can not allocate HCI device");
         |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     687 |                 goto err_hdev;
         |                 ~~~~~~~~~~~~~~
     688 |         }
         |         ~
   drivers/bluetooth/btmrvl_main.c:682:9: note: initialize the variable 'ret' to silence this warning
     682 |         int ret;
         |                ^
         |                 = 0
   1 warning generated.


vim +685 drivers/bluetooth/btmrvl_main.c

132ff4e5fa8dfb Bing Zhao              2009-06-02  677  
64061607eab7cb Bing Zhao              2010-03-03  678  int btmrvl_register_hdev(struct btmrvl_private *priv)
132ff4e5fa8dfb Bing Zhao              2009-06-02  679  {
132ff4e5fa8dfb Bing Zhao              2009-06-02  680  	struct hci_dev *hdev = NULL;
70a7808b50b119 Abhishek Pandit-Subedi 2020-06-10  681  	struct btmrvl_sdio_card *card = priv->btmrvl_dev.card;
132ff4e5fa8dfb Bing Zhao              2009-06-02  682  	int ret;
132ff4e5fa8dfb Bing Zhao              2009-06-02  683  
132ff4e5fa8dfb Bing Zhao              2009-06-02  684  	hdev = hci_alloc_dev();
132ff4e5fa8dfb Bing Zhao              2009-06-02 @685  	if (!hdev) {
132ff4e5fa8dfb Bing Zhao              2009-06-02  686  		BT_ERR("Can not allocate HCI device");
132ff4e5fa8dfb Bing Zhao              2009-06-02  687  		goto err_hdev;
132ff4e5fa8dfb Bing Zhao              2009-06-02  688  	}
132ff4e5fa8dfb Bing Zhao              2009-06-02  689  
132ff4e5fa8dfb Bing Zhao              2009-06-02  690  	priv->btmrvl_dev.hcidev = hdev;
155961e8001719 David Rheinsberg       2012-02-09  691  	hci_set_drvdata(hdev, priv);
132ff4e5fa8dfb Bing Zhao              2009-06-02  692  
c13854cef47510 Marcel Holtmann        2010-02-08  693  	hdev->bus   = HCI_SDIO;
132ff4e5fa8dfb Bing Zhao              2009-06-02  694  	hdev->open  = btmrvl_open;
132ff4e5fa8dfb Bing Zhao              2009-06-02  695  	hdev->close = btmrvl_close;
132ff4e5fa8dfb Bing Zhao              2009-06-02  696  	hdev->flush = btmrvl_flush;
132ff4e5fa8dfb Bing Zhao              2009-06-02  697  	hdev->send  = btmrvl_send_frame;
4b245722cabc6e Amitkumar Karwar       2013-10-01  698  	hdev->setup = btmrvl_setup;
27b869f59d5d98 Amitkumar Karwar       2014-07-18  699  	hdev->set_bdaddr = btmrvl_set_bdaddr;
4539ca67fe8ede Luiz Augusto von Dentz 2021-10-01  700  	hdev->wakeup = btmrvl_wakeup;
70a7808b50b119 Abhishek Pandit-Subedi 2020-06-10  701  	SET_HCIDEV_DEV(hdev, &card->func->dev);
64061607eab7cb Bing Zhao              2010-03-03  702  
132ff4e5fa8dfb Bing Zhao              2009-06-02  703  	ret = hci_register_dev(hdev);
132ff4e5fa8dfb Bing Zhao              2009-06-02  704  	if (ret < 0) {
132ff4e5fa8dfb Bing Zhao              2009-06-02  705  		BT_ERR("Can not register HCI device");
b10393b3962ee8 Wentao Liang           2026-06-26  706  		goto err_hci_register_dev_free;
132ff4e5fa8dfb Bing Zhao              2009-06-02  707  	}
132ff4e5fa8dfb Bing Zhao              2009-06-02  708  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki