Bluetooth: hci_ll: Fix NULL pointer deref on FW upload failure
diff mbox series

Message ID 20170415215413.15648-1-sre@kernel.org
State New, archived
Headers show
Series
  • Bluetooth: hci_ll: Fix NULL pointer deref on FW upload failure
Related show

Commit Message

Sebastian Reichel April 15, 2017, 9:54 p.m. UTC
Avoid NULL pointer dereference occurring due to freeing
skb containing an error pointer. It can easily be triggered
by using the driver with broken uart (i.e. due to misconfigured
pinmuxing).

Fixes: 371805522f87 ("bluetooth: hci_uart: add LL protocol serdev driver support")
Signed-off-by: Sebastian Reichel <sre@kernel.org>
---
 drivers/bluetooth/hci_ll.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Marcel Holtmann April 16, 2017, 6:32 p.m. UTC | #1
Hi Sebastian,

> Avoid NULL pointer dereference occurring due to freeing
> skb containing an error pointer. It can easily be triggered
> by using the driver with broken uart (i.e. due to misconfigured
> pinmuxing).
> 
> Fixes: 371805522f87 ("bluetooth: hci_uart: add LL protocol serdev driver support")
> Signed-off-by: Sebastian Reichel <sre@kernel.org>
> ---
> drivers/bluetooth/hci_ll.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)

patch has been applied to bluetooth-next tree.

Regards

Marcel

Patch
diff mbox series

diff --git a/drivers/bluetooth/hci_ll.c b/drivers/bluetooth/hci_ll.c
index 485e8eb04542..adc444f309a3 100644
--- a/drivers/bluetooth/hci_ll.c
+++ b/drivers/bluetooth/hci_ll.c
@@ -537,8 +537,7 @@  static int read_local_version(struct hci_dev *hdev)
 	if (IS_ERR(skb)) {
 		bt_dev_err(hdev, "Reading TI version information failed (%ld)",
 			   PTR_ERR(skb));
-		err = PTR_ERR(skb);
-		goto out;
+		return PTR_ERR(skb);
 	}
 	if (skb->len != sizeof(*ver)) {
 		err = -EILSEQ;