Re: [PATCH 0/2] Bluetooth: btrtl: Fix NULL return on errors in btrtl_initialize()

[Tzung-Bi Shih <tzungbi@kernel.org>]

On Tue, Oct 27, 2026 at 07:21:46AM +0000, Tzung-Bi Shih wrote:
> In btrtl_initialize(), the `err_free` error path frees `btrtl_dev` and
> returns `ERR_PTR(ret)`.  Because earlier calls in btrtl_initialize() set
> `ret` to 0 on success, any subsequent failure path that jumps to
> `err_free` without setting `ret` to a negative error code causes
> btrtl_initialize() to return `ERR_PTR(0)` (`NULL`).
> 
> Since the caller btrtl_setup_realtek() only checks `IS_ERR(btrtl_dev)`,
> a `NULL` return bypasses the error check and causes a NULL pointer
> dereference in btrtl_download_firmware().
> 
> - Patch 1 fixes a NULL pointer dereference observed when
>   btrtl_vendor_read_reg16() fails.
> - Patch 2 fixes a similar issue found by inspection when bt_skb_alloc()
>   fails.
> 
> Tzung-Bi Shih (2):
>   Bluetooth: btrtl: Propagate errors if btrtl_vendor_read_reg16() fails
>   Bluetooth: btrtl: Return -ENOMEM if bt_skb_alloc() fails
> 
>  drivers/bluetooth/btrtl.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)

Hi,

Does the series look good to you, or is there anything you'd like me to
change?