From nobody Tue Jun 23 03:08:10 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2251EC433F5 for ; Fri, 11 Mar 2022 08:35:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233129AbiCKIgk (ORCPT ); Fri, 11 Mar 2022 03:36:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229626AbiCKIgi (ORCPT ); Fri, 11 Mar 2022 03:36:38 -0500 Received: from mail.meizu.com (edge05.meizu.com [157.122.146.251]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 95C271BA14B for ; Fri, 11 Mar 2022 00:35:34 -0800 (PST) Received: from IT-EXMB-1-125.meizu.com (172.16.1.125) by mz-mail12.meizu.com (172.16.1.108) with Microsoft SMTP Server (TLS) id 14.3.487.0; Fri, 11 Mar 2022 16:35:34 +0800 Received: from meizu.meizu.com (172.16.137.70) by IT-EXMB-1-125.meizu.com (172.16.1.125) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2308.14; Fri, 11 Mar 2022 16:35:32 +0800 From: Haowen Bai To: , , , CC: , , "Haowen Bai" Subject: [PATCH] staging: greybus: Fix potential NULL dereference Date: Fri, 11 Mar 2022 16:35:30 +0800 Message-ID: <1646987730-7597-1-git-send-email-baihaowen@meizu.com> X-Mailer: git-send-email 2.7.4 MIME-Version: 1.0 X-Originating-IP: [172.16.137.70] X-ClientProxiedBy: IT-EXMB-1-126.meizu.com (172.16.1.126) To IT-EXMB-1-125.meizu.com (172.16.1.125) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix following coccicheck warning: drivers/staging/greybus/bootrom.c:301:35-39: ERROR: fw is NULL but derefere= nced. When goto queue_work but dereference Uninitialized fw will trigger a NULL=20 dereference. Signed-off-by: Haowen Bai --- drivers/staging/greybus/bootrom.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bo= otrom.c index a8efb86..6f3926b 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -252,14 +252,6 @@ static int gb_bootrom_get_firmware(struct gb_operation= *op) /* Disable timeouts */ gb_bootrom_cancel_timeout(bootrom); =20 - if (op->request->payload_size !=3D sizeof(*firmware_request)) { - dev_err(dev, "%s: Illegal size of get firmware request (%zu %zu)\n", - __func__, op->request->payload_size, - sizeof(*firmware_request)); - ret =3D -EINVAL; - goto queue_work; - } - mutex_lock(&bootrom->mutex); =20 fw =3D bootrom->fw; @@ -269,6 +261,15 @@ static int gb_bootrom_get_firmware(struct gb_operation= *op) goto unlock; } =20 + if (op->request->payload_size !=3D sizeof(*firmware_request)) { + dev_err(dev, "%s: Illegal size of get firmware request (%zu %zu)\n", + __func__, op->request->payload_size, + sizeof(*firmware_request)); + ret =3D -EINVAL; + mutex_unlock(&bootrom->mutex); + goto queue_work; + } + firmware_request =3D op->request->payload; offset =3D le32_to_cpu(firmware_request->offset); size =3D le32_to_cpu(firmware_request->size); --=20 2.7.4