In gb_bootrom_get_firmware(), the 'fw' pointer could be NULL if the
function jumps to the 'unlock' label. The execution flow continues
into the 'queue_work' block where 'fw->size' is accessed, leading to
a null pointer dereference.

Fix this by adding a NULL check for 'fw' before accessing its members.

Signed-off-by: Oarora Etimis <OaroraEtimis@gmail.com>
---
 drivers/staging/greybus/bootrom.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
index 83921d90c322..50c80475d241 100644
--- a/drivers/staging/greybus/bootrom.c
+++ b/drivers/staging/greybus/bootrom.c
@@ -298,7 +298,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
 
 queue_work:
 	/* Refresh timeout */
-	if (!ret && (offset + size == fw->size))
+	if (!ret && fw && (offset + size == fw->size))
 		next_request = NEXT_REQ_READY_TO_BOOT;
 	else
 		next_request = NEXT_REQ_GET_FIRMWARE;
-- 
2.47.3

On Mon, Mar 16, 2026 at 02:20:28AM +0800, Oarora Etimis wrote:
> In gb_bootrom_get_firmware(), the 'fw' pointer could be NULL if the
> function jumps to the 'unlock' label. The execution flow continues
> into the 'queue_work' block where 'fw->size' is accessed, leading to
> a null pointer dereference.
> 
> Fix this by adding a NULL check for 'fw' before accessing its members.
> 
> Signed-off-by: Oarora Etimis <OaroraEtimis@gmail.com>
> ---
>  drivers/staging/greybus/bootrom.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
> index 83921d90c322..50c80475d241 100644
> --- a/drivers/staging/greybus/bootrom.c
> +++ b/drivers/staging/greybus/bootrom.c
> @@ -298,7 +298,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
>  
>  queue_work:
>  	/* Refresh timeout */
> -	if (!ret && (offset + size == fw->size))
> +	if (!ret && fw && (offset + size == fw->size))

Was this a static checker false positive?  Which checker are you using?

If fw is NULL then "ret" is a negative error code so the original code
is fine.

regards,
dan carpenter

>  		next_request = NEXT_REQ_READY_TO_BOOT;
>  	else
>  		next_request = NEXT_REQ_GET_FIRMWARE;
> -- 
> 2.47.3
>