[PATCH] Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

[PATCH] Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

[Rong Zhang]

When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally
ignores all security headers. However, the implementation simply breaks
from a switch statement and leaks uninitialized return code `rc' (if the
first section is a security one) or the previous section's `rc'.

Fix it by really skipping a loop with `continue'. For consistency and
readability, also do the same for the default case.

Fixes: 9a24ce5e29b1 ("Bluetooth: btrtl: Firmware format v2 support")
Cc: stable@vger.kernel.org
Signed-off-by: Rong Zhang <i@rong.moe>
---
 drivers/bluetooth/btrtl.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 03fa9409e3ee..d29813331603 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -591,7 +591,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 			 * headers.
 			 */
 			if (!key_id)
-				break;
+				continue;
 			rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
 						 ptr, section_len);
 			break;
@@ -600,8 +600,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 						 ptr, section_len);
 			break;
 		default:
-			rc = 0;
-			break;
+			continue;
 		}
 		if (rc < 0) {
 			rtl_dev_err(hdev, "RTL: Parse section (%u) err %d",

---
base-commit: 786262be6048deab760f68c8acc2c85607165894
change-id: 0ec19dab-btrtl-fix-patch-sec-header-rc-leak-13534c2da4fd

Thanks,
Rong

RE: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

[bluez.test.bot]

[-- Attachment #1: Type: text/plain, Size: 1181 bytes --]

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=1156419

---Test result---

Test Summary:
CheckPatch                    PASS      0.56 seconds
VerifyFixes                   PASS      7.11 seconds
VerifySignedoff               PASS      1.45 seconds
GitLint                       PASS      0.99 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      29.02 seconds
CheckAllWarning               PASS      31.61 seconds
CheckSparse                   PASS      30.12 seconds
BuildKernel32                 PASS      33.64 seconds
CheckKernelLLVM               SKIP      0.00 seconds
TestRunnerSetup               PASS      521.59 seconds
IncrementalBuild              PASS      26.81 seconds

Details
##############################
Test: CheckKernelLLVM - SKIP
Desc: Build kernel with LLVM + context analysis
Output:
Clang not found


https://github.com/bluez/bluetooth-next/pull/691

---
Regards,
Linux Bluetooth

Re: [PATCH] Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 03 Sep 2026 03:18:59 +0800 you wrote:
> When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally
> ignores all security headers. However, the implementation simply breaks
> from a switch statement and leaks uninitialized return code `rc' (if the
> first section is a security one) or the previous section's `rc'.
> 
> Fix it by really skipping a loop with `continue'. For consistency and
> readability, also do the same for the default case.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
    https://git.kernel.org/bluetooth/bluetooth-next/c/0aab041d532f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html