[PATCH 2/2] Bluetooth: btrtl: Return -ENOMEM if bt_skb_alloc() fails

[Tzung-Bi Shih]

If bt_skb_alloc() fails in btrtl_initialize(), it jumps to `err_free`
without updating `ret` (which is 0 from earlier calls).  As a result, it
returns ERR_PTR(0) (NULL) to its caller, leading to a NULL pointer
dereference in btrtl_download_firmware().

Set `ret` to `-ENOMEM` before jumping to `err_free`.

Fixes: 9a24ce5e29b1 ("Bluetooth: btrtl: Firmware format v2 support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Tzung-Bi Shih <tzungbi@xxxxxxxxxx>
---
 drivers/bluetooth/btrtl.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index d2c2e79800fc..35a2c9d3380c 100644
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -1143,8 +1143,10 @@ struct btrtl_device_info *btrtl_initialize(struct hci_dev *hdev,
 
 	if (btrtl_dev->drop_fw) {
 		skb = bt_skb_alloc(sizeof(*cmd), GFP_KERNEL);
-		if (!skb)
+		if (!skb) {
+			ret = -ENOMEM;
 			goto err_free;
+		}
 
 		cmd = skb_put(skb, HCI_COMMAND_HDR_SIZE);
 		cmd->opcode = cpu_to_le16(0xfc66);
-- 
2.56.0.307.g5fe7bd680c-goog