From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754878AbdDOVy0 (ORCPT ); Sat, 15 Apr 2017 17:54:26 -0400 Received: from mail.kernel.org ([198.145.29.136]:53324 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754157AbdDOVyZ (ORCPT ); Sat, 15 Apr 2017 17:54:25 -0400 From: Sebastian Reichel To: Sebastian Reichel , Marcel Holtmann , Gustavo Padovan , Rob Herring Cc: linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] Bluetooth: hci_ll: Fix NULL pointer deref on FW upload failure Date: Sat, 15 Apr 2017 23:54:13 +0200 Message-Id: <20170415215413.15648-1-sre@kernel.org> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170415194854.byado7bxupbdhivp@earth> References: <20170415194854.byado7bxupbdhivp@earth> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Avoid NULL pointer dereference occurring due to freeing skb containing an error pointer. It can easily be triggered by using the driver with broken uart (i.e. due to misconfigured pinmuxing). Fixes: 371805522f87 ("bluetooth: hci_uart: add LL protocol serdev driver support") Signed-off-by: Sebastian Reichel --- drivers/bluetooth/hci_ll.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c index 485e8eb04542..adc444f309a3 100644 --- a/drivers/bluetooth/hci_ll.c +++ b/drivers/bluetooth/hci_ll.c @@ -537,8 +537,7 @@ static int read_local_version(struct hci_dev *hdev) if (IS_ERR(skb)) { bt_dev_err(hdev, "Reading TI version information failed (%ld)", PTR_ERR(skb)); - err = PTR_ERR(skb); - goto out; + return PTR_ERR(skb); } if (skb->len != sizeof(*ver)) { err = -EILSEQ; -- 2.11.0