linux-kernel - [PATCH] staging: greybus: fix fw is NULL but dereferenced

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1616667566-58997-1-git-send-email-dj0227@163.com>
Date:   Thu, 25 Mar 2021 18:19:26 +0800
From:   Jian Dong <dj0227@....com>
To:     vireshk@...nel.org, johan@...nel.org, elder@...nel.org,
        gregkh@...uxfoundation.org
Cc:     greybus-dev@...ts.linaro.org, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org, huyue2@...ong.com,
        Jian Dong <dongjian@...ong.com>
Subject: [PATCH]  staging: greybus: fix fw is NULL but dereferenced

From: Jian Dong <dongjian@...ong.com>

 fixes coccicheck Error:

 drivers/staging/greybus/bootrom.c:301:41-45: ERROR:
 fw is NULL but dereferenced.

 if procedure goto label directly, ret will be nefative, so the fw is NULL
 and the if(condition) end with dereferenced fw. let's fix it.

Signed-off-by: Jian Dong <dongjian@...ong.com>
---
 drivers/staging/greybus/bootrom.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
index a8efb86..0439efa 100644
--- a/drivers/staging/greybus/bootrom.c
+++ b/drivers/staging/greybus/bootrom.c
@@ -246,7 +246,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
 	struct gb_bootrom_get_firmware_response *firmware_response;
 	struct device *dev = &op->connection->bundle->dev;
 	unsigned int offset, size;
-	enum next_request_type next_request;
+	enum next_request_type next_request = NEXT_REQ_GET_FIRMWARE;
 	int ret = 0;
 
 	/* Disable timeouts */
@@ -298,10 +298,10 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
 
 queue_work:
 	/* Refresh timeout */
-	if (!ret && (offset + size == fw->size))
-		next_request = NEXT_REQ_READY_TO_BOOT;
-	else
+	if (!!ret)
 		next_request = NEXT_REQ_GET_FIRMWARE;
+	else if (offset + size == fw->size)
+		next_request = NEXT_REQ_READY_TO_BOOT;
 
 	gb_bootrom_set_timeout(bootrom, next_request, NEXT_REQ_TIMEOUT_MS);
 
-- 
1.9.1