Skip to content

Commit 60cc288

Browse files
committed
Merge: CVE-2024-57988: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6461 JIRA: https://issues.redhat.com/browse/RHEL-81375 CVE: CVE-2024-57988 ``` commit b88655b Author: Charles Han <hanchunchao@inspur.com> Date: Fri Dec 27 17:20:46 2024 +0800 Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() devm_kstrdup() can return a NULL pointer on failure,but this returned value in btbcm_get_board_name() is not checked. Add NULL check in btbcm_get_board_name(), to handle kernel NULL pointer dereference error. Fixes: f9183ea ("Bluetooth: btbcm: Use devm_kstrdup()") Signed-off-by: Charles Han <hanchunchao@inspur.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>``` Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> --- <small>Created 2025-02-27 18:42 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://gitlab.com/cki-project/kernel-workflow/-/issues/new?issue%5Btitle%5D=backporter%20webhook%20issue)</small> Approved-by: Bastien Nocera <bnocera@redhat.com> Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Augusto Caringi <acaringi@redhat.com>
2 parents 6d81ff1 + 5c6d7d5 commit 60cc288

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

drivers/bluetooth/btbcm.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -554,6 +554,9 @@ static const char *btbcm_get_board_name(struct device *dev)
554554

555555
/* get rid of any '/' in the compatible string */
556556
board_type = devm_kstrdup(dev, tmp, GFP_KERNEL);
557+
if (!board_type)
558+
return NULL;
559+
557560
strreplace(board_type, '/', '-');
558561
of_node_put(root);
559562

0 commit comments

Comments
 (0)