linux-kernel - drivers/bluetooth/btintel_pcie.c:386 btintel_pcie_recv_frame() warn: variable dereferenced before check 'data' (see line 380)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7446b314-53f8-4ec7-9ff7-ae47defc43fb@moroto.mountain>
Date: Thu, 23 May 2024 15:30:32 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: oe-kbuild@...ts.linux.dev, Kiran K <kiran.k@...el.com>
Cc: lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
	linux-kernel@...r.kernel.org,
	Luiz Augusto von Dentz <luiz.von.dentz@...el.com>,
	Chandrashekar <chandrashekar.devegowda@...el.com>
Subject: drivers/bluetooth/btintel_pcie.c:386 btintel_pcie_recv_frame() warn:
 variable dereferenced before check 'data' (see line 380)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   ea5f6ad9ad9645733b72ab53a98e719b460d36a6
commit: 6e65a09f927566f257322358d429b267548473eb Bluetooth: btintel_pcie: Add *setup* function to download firmware
config: alpha-randconfig-r081-20240516 (https://download.01.org/0day-ci/archive/20240517/202405170424.97VIwnBn-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 13.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
| Closes: https://lore.kernel.org/r/202405170424.97VIwnBn-lkp@intel.com/

smatch warnings:
drivers/bluetooth/btintel_pcie.c:386 btintel_pcie_recv_frame() warn: variable dereferenced before check 'data' (see line 380)

vim +/data +386 drivers/bluetooth/btintel_pcie.c

6e65a09f927566 Kiran K          2024-05-07  371  static int btintel_pcie_recv_frame(struct btintel_pcie_data *data,
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  372  				       struct sk_buff *skb)
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  373  {
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  374  	int ret;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  375  	u8 pkt_type;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  376  	u16 plen;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  377  	u32 pcie_pkt_type;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  378  	struct sk_buff *new_skb;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  379  	void *pdata;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 @380  	struct hci_dev *hdev = data->hdev;
                                                                               ^^^^^^^^^^
data dereferenced

c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  381  
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  382  	spin_lock(&data->hci_rx_lock);
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  383  
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  384  	/* The first 4 bytes indicates the Intel PCIe specific packet type */
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  385  	pdata = skb_pull_data(skb, BTINTEL_PCIE_HCI_TYPE_LEN);
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 @386  	if (!data) {
                                                            ^^^^^
Presumably this was supposed to check "pdata".

c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  387  		bt_dev_err(hdev, "Corrupted packet received");
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  388  		ret = -EILSEQ;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  389  		goto exit_error;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  390  	}
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  391  
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07  392  	pcie_pkt_type = get_unaligned_le32(pdata);

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki