]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev...
authorZijun Hu <zijun.hu@oss.qualcomm.com>
Mon, 1 Jun 2026 11:30:56 +0000 (04:30 -0700)
committerLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
Thu, 11 Jun 2026 18:24:39 +0000 (14:24 -0400)
hu->serdev is NULL for hci_uart attached via non-serdev paths, but
qca_dmp_hdr() unconditionally dereferences hu->serdev->dev.driver->name,
causing a NULL pointer dereference.

Fix by guarding the dereference with a NULL check and falling back to
"hci_ldisc_qca" for the non-serdev case.

Fixes: 06d3fdfcdf5c ("Bluetooth: hci_qca: Add qcom devcoredump support")
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
drivers/bluetooth/hci_qca.c

index cc7b34a61fa783d4358141912ea8682482f43b8a..2444471956197bae62a1c4c3a776c5591780ec02 100644 (file)
@@ -1028,7 +1028,7 @@ static void qca_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb)
        skb_put_data(skb, buf, strlen(buf));
 
        snprintf(buf, sizeof(buf), "Driver: %s\n",
-               hu->serdev->dev.driver->name);
+                hu->serdev ? hu->serdev->dev.driver->name : "hci_ldisc_qca");
        skb_put_data(skb, buf, strlen(buf));
 }