[PATCH] Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

[PATCH] Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

[Rong Zhang]

When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally
ignores all security headers. However, the implementation simply breaks
from a switch statement and leaks uninitialized return code `rc' (if the
first section is a security one) or the previous section's `rc'.

Fix it by really skipping a loop with `continue'. For consistency and
readability, also do the same for the default case.

Fixes: 9a24ce5e29b1 ("Bluetooth: btrtl: Firmware format v2 support")
Cc: stable@vger.kernel.org
Signed-off-by: Rong Zhang <i@rong.moe>
---
 drivers/bluetooth/btrtl.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 03fa9409e3ee..d29813331603 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -591,7 +591,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 			 * headers.
 			 */
 			if (!key_id)
-				break;
+				continue;
 			rc = btrtl_parse_section(hdev, btrtl_dev, opcode,
 						 ptr, section_len);
 			break;
@@ -600,8 +600,7 @@ static int rtlbt_parse_firmware_v2(struct hci_dev *hdev,
 						 ptr, section_len);
 			break;
 		default:
-			rc = 0;
-			break;
+			continue;
 		}
 		if (rc < 0) {
 			rtl_dev_err(hdev, "RTL: Parse section (%u) err %d",

---
base-commit: 786262be6048deab760f68c8acc2c85607165894
change-id: 0ec19dab-btrtl-fix-patch-sec-header-rc-leak-13534c2da4fd

Thanks,
Rong

Re: [PATCH] Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@intel.com>:

On Thu, 03 Sep 2026 03:18:59 +0800 you wrote:
> When key_id from chip is zero, rtlbt_parse_firmware_v2() intentionally
> ignores all security headers. However, the implementation simply breaks
> from a switch statement and leaks uninitialized return code `rc' (if the
> first section is a security one) or the previous section's `rc'.
> 
> Fix it by really skipping a loop with `continue'. For consistency and
> readability, also do the same for the default case.
> 
> [...]

Here is the summary with links:
  - Bluetooth: btrtl: Don't leak return code when parsing firmware format v2
    https://git.kernel.org/bluetooth/bluetooth-next/c/0aab041d532f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html