[PATCH 0/2] Bluetooth: btrtl: Fix NULL return on errors in btrtl_initialize()

[Tzung-Bi Shih]

In btrtl_initialize(), the `err_free` error path frees `btrtl_dev` and
returns `ERR_PTR(ret)`.  Because earlier calls in btrtl_initialize() set
`ret` to 0 on success, any subsequent failure path that jumps to
`err_free` without setting `ret` to a negative error code causes
btrtl_initialize() to return `ERR_PTR(0)` (`NULL`).

Since the caller btrtl_setup_realtek() only checks `IS_ERR(btrtl_dev)`,
a `NULL` return bypasses the error check and causes a NULL pointer
dereference in btrtl_download_firmware().

- Patch 1 fixes a NULL pointer dereference observed when
  btrtl_vendor_read_reg16() fails.
- Patch 2 fixes a similar issue found by inspection when bt_skb_alloc()
  fails.

Tzung-Bi Shih (2):
  Bluetooth: btrtl: Propagate errors if btrtl_vendor_read_reg16() fails
  Bluetooth: btrtl: Return -ENOMEM if bt_skb_alloc() fails

 drivers/bluetooth/btrtl.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

-- 
2.56.0.307.g5fe7bd680c-goog