[PATCH 1/2] Bluetooth: btrtl: Propagate errors if btrtl_vendor_read_reg16() fails

[Tzung-Bi Shih]

A NULL pointer dereference is observed in btrtl_download_firmware():

  [ 2592.730992] Bluetooth: btrtl_vendor_read_reg16() hci0: RTL: RTL: Read reg16 failed (-110)
  [ 2592.731005] Bluetooth: btusb_rtl_alloc_devcoredump() hci0: RTL: Failed to generate devcoredump
  [ 2592.731060] BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  [ 2592.731906] RIP: 0010:btrtl_download_firmware+0x19/0xb10 [btrtl]
  ...
  [ 2592.732791] Call Trace:
  [ 2592.732883]  <TASK>
  [ 2592.732935]  btrtl_setup_realtek+0x30/0x60 [btrtl]

When btrtl_vendor_read_reg16() for RTL_SEC_PROJ fails in
btrtl_initialize(), the error code is stored in `rc` instead of `ret`,
causing the err_free path to return ERR_PTR(0) (NULL).  As a result,
IS_ERR(btrtl_dev) in btrtl_setup_realtek() evaluates to false and NULL
is passed to btrtl_download_firmware(), leading to a NULL pointer
dereference.

Store the return value in `ret` so the error is properly propagated to
the caller.

Fixes: cd8dbd9ef600 ("Bluetooth: btrtl: Avoid loading the config file on security chips")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tzung-Bi Shih <tzungbi@xxxxxxxxxx>
---
 drivers/bluetooth/btrtl.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index d29813331603..d2c2e79800fc 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1073,7 +1073,6 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 	u16 hci_rev, lmp_subver;
 	u8 hci_ver, lmp_ver, chip_type = 0;
 	int ret;
-	int rc;
 	u8 key_id;
 	u8 reg_val[2];
 
@@ -1185,8 +1184,8 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 		goto err_free;
 	}
 
-	rc = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
-	if (rc < 0)
+	ret = btrtl_vendor_read_reg16(hdev, RTL_SEC_PROJ, reg_val);
+	if (ret < 0)
 		goto err_free;
 
 	key_id = reg_val[0];
-- 
2.56.0.307.g5fe7bd680c-goog