[PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev

[PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev

[Wentao Liang]

In btmrvl_register_hdev(), when hci_register_dev() fails, the
function frees the hci_dev via hci_free_dev() but leaves
priv->btmrvl_dev.hcidev as a dangling pointer. While the subsequent
cleanup code does not currently access it, setting it to NULL is a
defensive fix that prevents potential use-after-free.

Additionally, the function always returns -ENOMEM on the
hci_register_dev() failure path, discarding the actual error code.
Fix this by preserving and returning the original error code.

Cc: stable@vger.kernel.org
Fixes: 132ff4e5fa8d ("Bluetooth: Add btmrvl driver for Marvell Bluetooth devices")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/bluetooth/btmrvl_main.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btmrvl_main.c b/drivers/bluetooth/btmrvl_main.c
index d6f0ad0b4b6e..3a4c8abae05b 100644
--- a/drivers/bluetooth/btmrvl_main.c
+++ b/drivers/bluetooth/btmrvl_main.c
@@ -683,7 +683,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 	ret = hci_register_dev(hdev);
 	if (ret < 0) {
 		BT_ERR("Can not register HCI device");
-		goto err_hci_register_dev;
+		goto err_hci_register_dev_free;
 	}
 
 #ifdef CONFIG_DEBUG_FS
@@ -692,8 +692,9 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 
 	return 0;
 
-err_hci_register_dev:
+err_hci_register_dev_free:
 	hci_free_dev(hdev);
+	priv->btmrvl_dev.hcidev = NULL;
 
 err_hdev:
 	/* Stop the thread servicing the interrupts */
@@ -702,7 +703,7 @@ int btmrvl_register_hdev(struct btmrvl_private *priv)
 	btmrvl_free_adapter(priv);
 	kfree(priv);
 
-	return -ENOMEM;
+	return ret;
 }
 EXPORT_SYMBOL_GPL(btmrvl_register_hdev);
 
-- 
2.39.5 (Apple Git-154)

Re: [PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev

[kernel test robot]

Hi Wentao,

kernel test robot noticed the following build warnings:

[auto build test WARNING on bluetooth-next/master]
[also build test WARNING on bluetooth/master linus/master v7.2-rc6 next-20260807]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Wentao-Liang/btmrvl-Fix-hdev-dangling-pointer-and-error-code-in-register_hdev/20260808-022129
base:   https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master
patch link:    https://lore.kernel.org/r/20260625160607.81615-1-vulab%40iscas.ac.cn
patch subject: [PATCH] btmrvl: Fix hdev dangling pointer and error code in register_hdev
config: loongarch-defconfig (https://download.01.org/0day-ci/archive/20260809/202608090403.IZoIz1yQ-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 12df34b8469b8095359de8c249cb1b2753fadeea)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260809/202608090403.IZoIz1yQ-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608090403.IZoIz1yQ-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> drivers/bluetooth/btmrvl_main.c:685:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
     685 |         if (!hdev) {
         |             ^~~~~
   drivers/bluetooth/btmrvl_main.c:726:9: note: uninitialized use occurs here
     726 |         return ret;
         |                ^~~
   drivers/bluetooth/btmrvl_main.c:685:2: note: remove the 'if' if its condition is always false
     685 |         if (!hdev) {
         |         ^~~~~~~~~~~~
     686 |                 BT_ERR("Can not allocate HCI device");
         |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     687 |                 goto err_hdev;
         |                 ~~~~~~~~~~~~~~
     688 |         }
         |         ~
   drivers/bluetooth/btmrvl_main.c:682:9: note: initialize the variable 'ret' to silence this warning
     682 |         int ret;
         |                ^
         |                 = 0
   1 warning generated.


vim +685 drivers/bluetooth/btmrvl_main.c

132ff4e5fa8dfb Bing Zhao              2009-06-02  677  
64061607eab7cb Bing Zhao              2010-03-03  678  int btmrvl_register_hdev(struct btmrvl_private *priv)
132ff4e5fa8dfb Bing Zhao              2009-06-02  679  {
132ff4e5fa8dfb Bing Zhao              2009-06-02  680  	struct hci_dev *hdev = NULL;
70a7808b50b119 Abhishek Pandit-Subedi 2020-06-10  681  	struct btmrvl_sdio_card *card = priv->btmrvl_dev.card;
132ff4e5fa8dfb Bing Zhao              2009-06-02  682  	int ret;
132ff4e5fa8dfb Bing Zhao              2009-06-02  683  
132ff4e5fa8dfb Bing Zhao              2009-06-02  684  	hdev = hci_alloc_dev();
132ff4e5fa8dfb Bing Zhao              2009-06-02 @685  	if (!hdev) {
132ff4e5fa8dfb Bing Zhao              2009-06-02  686  		BT_ERR("Can not allocate HCI device");
132ff4e5fa8dfb Bing Zhao              2009-06-02  687  		goto err_hdev;
132ff4e5fa8dfb Bing Zhao              2009-06-02  688  	}
132ff4e5fa8dfb Bing Zhao              2009-06-02  689  
132ff4e5fa8dfb Bing Zhao              2009-06-02  690  	priv->btmrvl_dev.hcidev = hdev;
155961e8001719 David Rheinsberg       2012-02-09  691  	hci_set_drvdata(hdev, priv);
132ff4e5fa8dfb Bing Zhao              2009-06-02  692  
c13854cef47510 Marcel Holtmann        2010-02-08  693  	hdev->bus   = HCI_SDIO;
132ff4e5fa8dfb Bing Zhao              2009-06-02  694  	hdev->open  = btmrvl_open;
132ff4e5fa8dfb Bing Zhao              2009-06-02  695  	hdev->close = btmrvl_close;
132ff4e5fa8dfb Bing Zhao              2009-06-02  696  	hdev->flush = btmrvl_flush;
132ff4e5fa8dfb Bing Zhao              2009-06-02  697  	hdev->send  = btmrvl_send_frame;
4b245722cabc6e Amitkumar Karwar       2013-10-01  698  	hdev->setup = btmrvl_setup;
27b869f59d5d98 Amitkumar Karwar       2014-07-18  699  	hdev->set_bdaddr = btmrvl_set_bdaddr;
4539ca67fe8ede Luiz Augusto von Dentz 2021-10-01  700  	hdev->wakeup = btmrvl_wakeup;
70a7808b50b119 Abhishek Pandit-Subedi 2020-06-10  701  	SET_HCIDEV_DEV(hdev, &card->func->dev);
64061607eab7cb Bing Zhao              2010-03-03  702  
132ff4e5fa8dfb Bing Zhao              2009-06-02  703  	ret = hci_register_dev(hdev);
132ff4e5fa8dfb Bing Zhao              2009-06-02  704  	if (ret < 0) {
132ff4e5fa8dfb Bing Zhao              2009-06-02  705  		BT_ERR("Can not register HCI device");
b10393b3962ee8 Wentao Liang           2026-06-26  706  		goto err_hci_register_dev_free;
132ff4e5fa8dfb Bing Zhao              2009-06-02  707  	}
132ff4e5fa8dfb Bing Zhao              2009-06-02  708  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki