[PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev

[Wentao Liang <vulab@iscas.ac.cn>]

In btmrvl_register_hdev(), when hci_register_dev() fails, the
function frees the hci_dev via hci_free_dev() but leaves
priv->btmrvl_dev.hcidev as a dangling pointer. While the subsequent
cleanup code does not currently access it, setting it to NULL is a
defensive fix that prevents potential use-after-free.

Additionally, the function always returns -ENOMEM on the
hci_register_dev() failure path, discarding the actual error code.
Fix this by preserving and returning the original error code.

Cc: stable@vger.kernel.org
Fixes: 132ff4e5fa8d ("Bluetooth: Add btmrvl driver for Marvell Bluetooth devices")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/bluetooth/btmrvl_main.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index d6f0ad0b4b6e..3a4c8abae05b 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -683,7 +683,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 	ret = hci_register_dev(hdev);
 	if (ret < 0) {
 		BT_ERR("Can not register HCI device");
-		goto err_hci_register_dev;
+		goto err_hci_register_dev_free;
 	}
 
 #ifdef CONFIG_DEBUG_FS
@@ -692,8 +692,9 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 
 	return 0;
 
-err_hci_register_dev:
+err_hci_register_dev_free:
 	hci_free_dev(hdev);
+	priv->btmrvl_dev.hcidev = NULL;
 
 err_hdev:
 	/* Stop the thread servicing the interrupts */
@@ -702,7 +703,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 	btmrvl_free_adapter(priv);
 	kfree(priv);
 
-	return -ENOMEM;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(btmrvl_register_hdev);
 
-- 
2.39.5 (Apple Git-154)