linux-kernel - Re: [PATCH] staging: greybus: fix fw is NULL but dereferenced

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210325105155.c52zc7mswoh33yjz@vireshk-i7>
Date:   Thu, 25 Mar 2021 16:21:55 +0530
From:   Viresh Kumar <viresh.kumar@...aro.org>
To:     Jian Dong <dj0227@....com>
Cc:     vireshk@...nel.org, johan@...nel.org, elder@...nel.org,
        gregkh@...uxfoundation.org, greybus-dev@...ts.linaro.org,
        devel@...verdev.osuosl.org, linux-kernel@...r.kernel.org,
        huyue2@...ong.com, Jian Dong <dongjian@...ong.com>
Subject: Re: [PATCH]  staging: greybus: fix fw is NULL but dereferenced

On 25-03-21, 18:19, Jian Dong wrote:
> From: Jian Dong <dongjian@...ong.com>
> 
>  fixes coccicheck Error:
> 
>  drivers/staging/greybus/bootrom.c:301:41-45: ERROR:
>  fw is NULL but dereferenced.
> 
>  if procedure goto label directly, ret will be nefative, so the fw is NULL
>  and the if(condition) end with dereferenced fw. let's fix it.

No, fw is accessed only for !ret case.

> Signed-off-by: Jian Dong <dongjian@...ong.com>
> ---
>  drivers/staging/greybus/bootrom.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
> index a8efb86..0439efa 100644
> --- a/drivers/staging/greybus/bootrom.c
> +++ b/drivers/staging/greybus/bootrom.c
> @@ -246,7 +246,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
>  	struct gb_bootrom_get_firmware_response *firmware_response;
>  	struct device *dev = &op->connection->bundle->dev;
>  	unsigned int offset, size;
> -	enum next_request_type next_request;
> +	enum next_request_type next_request = NEXT_REQ_GET_FIRMWARE;
>  	int ret = 0;
>  
>  	/* Disable timeouts */
> @@ -298,10 +298,10 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
>  
>  queue_work:
>  	/* Refresh timeout */
> -	if (!ret && (offset + size == fw->size))
> -		next_request = NEXT_REQ_READY_TO_BOOT;
> -	else
> +	if (!!ret)
>  		next_request = NEXT_REQ_GET_FIRMWARE;
> +	else if (offset + size == fw->size)
> +		next_request = NEXT_REQ_READY_TO_BOOT;
>  
>  	gb_bootrom_set_timeout(bootrom, next_request, NEXT_REQ_TIMEOUT_MS);

The code is fine AFAICT, the coccicheck is buggy as it is detecting a
bug here.

-- 
viresh