Re: [PATCH] Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown

[patchwork-bot+bluetooth]

Hello:

This patch was applied to bluetooth/bluetooth-next.git (master)
by Luiz Augusto von Dentz <luiz.von.dentz@xxxxxxxxx>:

On Fri,  2 Oct 2026 08:07:52 +0100 you wrote:
> syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an
> RFCOMM tty is closed.
> 
> rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only
> then registers the tty device and saves it in dev->tty_dev. If that
> registration fails, dev->tty_dev is never set at all. The device can be
> looked up in the meantime, so an open() of /dev/rfcommN gets through
> rfcomm_tty_install() and attaches to it. When that tty is closed again,
> rfcomm_dev_shutdown() uses dev->tty_dev without checking it:
> 
> [...]

Here is the summary with links:
  - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown
    https://git.kernel.org/bluetooth/bluetooth-next/c/08e90633377f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html