Commit 324dddea authored by Dan Carpenter's avatar Dan Carpenter Committed by Luiz Augusto von Dentz
Browse files

Bluetooth: btrtl: Prevent potential NULL dereference 



The btrtl_initialize() function checks that rtl_load_file() either
had an error or it loaded a zero length file.  However, if it loaded
a zero length file then the error code is not set correctly.  It
results in an error pointer vs NULL bug, followed by a NULL pointer
dereference.  This was detected by Smatch:

drivers/bluetooth/btrtl.c:592 btrtl_initialize() warn: passing zero to 'ERR_PTR'

Fixes: 26503ad2 ("Bluetooth: btrtl: split the device initialization into smaller parts")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
parent eb73b5a9

drivers/bluetooth/btrtl.c

+2 −0
Original line number Diff line number Diff line
@@ -1215,6 +1215,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev, 
			rtl_dev_err(hdev, "mandatory config file %s not found",

				    btrtl_dev->ic_info->cfg_name);

			ret = btrtl_dev->cfg_len;

			if (!ret)

				ret = -EINVAL;

			goto err_free;

		}

	}