From a0b8969636bf5628cb377843a85524f8366330a6 Mon Sep 17 00:00:00 2001 From: zhanghongyu Date: Mon, 13 Apr 2026 14:35:59 +0800 Subject: [PATCH] net/bluetooth: fix null pointer dereference in bluetooth_sendmsg Move the NULL check for radio pointer before the DEBUGASSERT that dereferences it. Previously DEBUGASSERT(radio->r_dev.d_lltype == ...) was executed before verifying radio != NULL, which would crash when the device is not found. Signed-off-by: zhanghongyu --- net/bluetooth/bluetooth_sendmsg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/bluetooth_sendmsg.c b/net/bluetooth/bluetooth_sendmsg.c index 4c4e6dd4cb8..20ea320a585 100644 --- a/net/bluetooth/bluetooth_sendmsg.c +++ b/net/bluetooth/bluetooth_sendmsg.c @@ -284,12 +284,12 @@ static ssize_t bluetooth_sendto(FAR struct socket *psock, radio = (FAR struct radio_driver_s *)netdev_findbyindex(conn->bc_ldev + 1); - DEBUGASSERT(radio->r_dev.d_lltype == NET_LL_BLUETOOTH); - if (radio == NULL) { return -ENODEV; } + + DEBUGASSERT(radio->r_dev.d_lltype == NET_LL_BLUETOOTH); } else {