Skip to content

Commit 324ddde

Browse files
Dan CarpenterVudentz
authored andcommitted
Bluetooth: btrtl: Prevent potential NULL dereference
The btrtl_initialize() function checks that rtl_load_file() either had an error or it loaded a zero length file. However, if it loaded a zero length file then the error code is not set correctly. It results in an error pointer vs NULL bug, followed by a NULL pointer dereference. This was detected by Smatch: drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR' Fixes: 26503ad ("Bluetooth: btrtl: split the device initialization into smaller parts") Signed-off-by: Dan Carpenter <[email protected]> Reviewed-by: Hans de Goede <[email protected]> Signed-off-by: Luiz Augusto von Dentz <[email protected]>
1 parent eb73b5a commit 324ddde

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

drivers/bluetooth/btrtl.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1215,6 +1215,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
12151215
rtl_dev_err(hdev, "mandatory config file %s not found",
12161216
btrtl_dev->ic_info->cfg_name);
12171217
ret = btrtl_dev->cfg_len;
1218+
if (!ret)
1219+
ret = -EINVAL;
12181220
goto err_free;
12191221
}
12201222
}

0 commit comments

Comments
 (0)