Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()

Commit Message

Max Chou Dec. 31, 2024, 6:57 a.m. UTC

From: Max Chou <[e-mail]>

If insert an USB dongle which chip is not maintained in ic_id_table, it
will hit the NULL point accessed. Add a null point check to avoid the
Kernel Oops.

Fixes: b39910bb54d9 ("Bluetooth: Populate hci_set_hw_info for Intel and Realtek")
Reviewed-by: Alex Lu <[e-mail]>
Signed-off-by: Max Chou <[e-mail]>
---
 drivers/bluetooth/btrtl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

[e-mail] Dec. 31, 2024, 7:31 a.m. UTC | #1

This is automated email and please do not reply to this email!

Dear submitter,

Thank you for submitting the patches to the linux bluetooth mailing list.
This is a CI test results with your patch series:
PW Link:https://patchwork.kernel.org/project/bluetooth/list/?series=921519

---Test result---

Test Summary:
CheckPatch                    PENDING   0.38 seconds
GitLint                       PENDING   0.43 seconds
SubjectPrefix                 PASS      0.07 seconds
BuildKernel                   PASS      25.78 seconds
CheckAllWarning               PASS      27.93 seconds
CheckSparse                   PASS      31.26 seconds
BuildKernel32                 PASS      25.25 seconds
TestRunnerSetup               PASS      445.05 seconds
TestRunner_l2cap-tester       PASS      20.67 seconds
TestRunner_iso-tester         PASS      36.51 seconds
TestRunner_bnep-tester        PASS      4.89 seconds
TestRunner_mgmt-tester        FAIL      126.21 seconds
TestRunner_rfcomm-tester      PASS      7.63 seconds
TestRunner_sco-tester         PASS      9.47 seconds
TestRunner_ioctl-tester       PASS      9.00 seconds
TestRunner_mesh-tester        FAIL      6.30 seconds
TestRunner_smp-tester         PASS      7.10 seconds
TestRunner_userchan-tester    PASS      5.09 seconds
IncrementalBuild              PENDING   1.01 seconds

Details
##############################
Test: CheckPatch - PENDING
Desc: Run checkpatch.pl script
Output:

##############################
Test: GitLint - PENDING
Desc: Run gitlint
Output:

##############################
Test: TestRunner_mgmt-tester - FAIL
Desc: Run mgmt-tester with test-runner
Output:
Total: 490, Passed: 484 (98.8%), Failed: 2, Not Run: 4

Failed Test Cases
LL Privacy - Add Device 2 (2 Devices to AL)          Failed       0.168 seconds
LL Privacy - Set Flags 3 (2 Devices to RL)           Failed       0.165 seconds
##############################
Test: TestRunner_mesh-tester - FAIL
Desc: Run mesh-tester with test-runner
Output:
BUG: KASAN: slab-use-after-free in run_timer_softirq+0x76c/0x7d0
WARNING: CPU: 0 PID: 65 at kernel/workqueue.c:2257 __queue_work+0x687/0xb40
Total: 10, Passed: 9 (90.0%), Failed: 1, Not Run: 0

Failed Test Cases
Mesh - Send cancel - 1                               Failed       0.116 seconds
##############################
Test: IncrementalBuild - PENDING
Desc: Incremental build with the patches in the series
Output:



---
Regards,
Linux Bluetooth

[e-mail] Jan. 9, 2025, 4:17 p.m. UTC | #2

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <[e-mail]>:

On Tue, 31 Dec 2024 14:57:19 +0800 you wrote:
> From: Max Chou <[e-mail]>
> 
> If insert an USB dongle which chip is not maintained in ic_id_table, it
> will hit the NULL point accessed. Add a null point check to avoid the
> Kernel Oops.
> 
> Fixes: b39910bb54d9 ("Bluetooth: Populate hci_set_hw_info for Intel and Realtek")
> Reviewed-by: Alex Lu <[e-mail]>
> Signed-off-by: Max Chou <[e-mail]>
> 
> [...]

Here is the summary with links:
  - Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
    https://git.kernel.org/bluetooth/bluetooth-next/c/402e07c75d07

You are awesome, thank you!

Patch

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index 83025f457ca0..d3eba0d4a57d 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1351,12 +1351,14 @@  int btrtl_setup_realtek(struct hci_dev *hdev)
 
 	btrtl_set_quirks(hdev, btrtl_dev);
 
-	hci_set_hw_info(hdev,
+	if (btrtl_dev->ic_info) {
+		hci_set_hw_info(hdev,
 			"RTL lmp_subver=%u hci_rev=%u hci_ver=%u hci_bus=%u",
 			btrtl_dev->ic_info->lmp_subver,
 			btrtl_dev->ic_info->hci_rev,
 			btrtl_dev->ic_info->hci_ver,
 			btrtl_dev->ic_info->hci_bus);
+	}
 
 	btrtl_free(btrtl_dev);
 	return ret;