* [PATCH 1/2] Bluetooth: btrtl: Propagate errors if btrtl_vendor_read_reg16() fails
[not found] <20261027072148.3963826-1-tzungbi@kernel.org>
@ 2026-10-27 7:21 ` Tzung-Bi Shih
2026-10-27 7:21 ` [PATCH 2/2] Bluetooth: btrtl: Return -ENOMEM if bt_skb_alloc() fails Tzung-Bi Shih
1 sibling, 0 replies; 2+ messages in thread
From: Tzung-Bi Shih @ 2026-10-27 7:21 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz
Cc: Max Chou, tfiga, tzungbi, linux-bluetooth, linux-kernel, stable
A NULL pointer dereference is observed in btrtl_download_firmware():
[ 2592.730992] Bluetooth: btrtl_vendor_read_reg16() hci0: RTL: RTL: Read reg16 failed (-110)
[ 2592.731005] Bluetooth: btusb_rtl_alloc_devcoredump() hci0: RTL: Failed to generate devcoredump
[ 2592.731060] BUG: kernel NULL pointer dereference, address: 0000000000000000
...
[ 2592.731906] RIP: 0010:btrtl_download_firmware+0x19/0xb10 [btrtl]
...
[ 2592.732791] Call Trace:
[ 2592.732883] <TASK>
[ 2592.732935] btrtl_setup_realtek+0x30/0x60 [btrtl]
When btrtl_vendor_read_reg16() for RTL_SEC_PROJ fails in
btrtl_initialize(), the error code is stored in `rc` instead of `ret`,
causing the err_free path to return ERR_PTR(0) (NULL). As a result,
IS_ERR(btrtl_dev) in btrtl_setup_realtek() evaluates to false and NULL
is passed to btrtl_download_firmware(), leading to a NULL pointer
dereference.
Store the return value in `ret` so the error is properly propagated to
the caller.
Fixes: cd8dbd9ef600 ("Bluetooth: btrtl: Avoid loading the config file on security chips")
Cc: stable@vger.kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
---
drivers/bluetooth/btrtl.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index d29813331603..d2c2e79800fc 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1073,7 +1073,6 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
u16 hci_rev, lmp_subver;
u8 hci_ver, lmp_ver, chip_type = 0;
int ret;
- int rc;
u8 key_id;
u8 reg_val[2];
@@ -1185,8 +1184,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
goto err_free;
}
- rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
- if (rc < 0)
+ ret = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
+ if (ret < 0)
goto err_free;
key_id = reg_val[0];
--
2.56.0.307.g5fe7bd680c-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread* [PATCH 2/2] Bluetooth: btrtl: Return -ENOMEM if bt_skb_alloc() fails
[not found] <20261027072148.3963826-1-tzungbi@kernel.org>
2026-10-27 7:21 ` [PATCH 1/2] Bluetooth: btrtl: Propagate errors if btrtl_vendor_read_reg16() fails Tzung-Bi Shih
@ 2026-10-27 7:21 ` Tzung-Bi Shih
1 sibling, 0 replies; 2+ messages in thread
From: Tzung-Bi Shih @ 2026-10-27 7:21 UTC (permalink / raw)
To: Marcel Holtmann, Luiz Augusto von Dentz
Cc: Max Chou, tfiga, tzungbi, linux-bluetooth, linux-kernel, stable
If bt_skb_alloc() fails in btrtl_initialize(), it jumps to `err_free`
without updating `ret` (which is 0 from earlier calls). As a result, it
returns ERR_PTR(0) (NULL) to its caller, leading to a NULL pointer
dereference in btrtl_download_firmware().
Set `ret` to `-ENOMEM` before jumping to `err_free`.
Fixes: 9a24ce5e29b1 ("Bluetooth: btrtl: Firmware format v2 support")
Cc: stable@vger.kernel.org
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
---
drivers/bluetooth/btrtl.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index d2c2e79800fc..35a2c9d3380c 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1143,8 +1143,10 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
if (btrtl_dev->drop_fw) {
skb = bt_skb_alloc(sizeof(*cmd), GFP_KERNEL);
- if (!skb)
+ if (!skb) {
+ ret = -ENOMEM;
goto err_free;
+ }
cmd = skb_put(skb, HCI_COMMAND_HDR_SIZE);
cmd->opcode = cpu_to_le16(0xfc66);
--
2.56.0.307.g5fe7bd680c-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread