From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS, T_DKIMWL_WL_HIGH,UNPARSEABLE_RELAY,URIBL_BLOCKED,USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 498E5C43615 for ; Fri, 24 Aug 2018 10:27:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E4F4421567 for ; Fri, 24 Aug 2018 10:27:56 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=oracle.com header.i=@oracle.com header.b="cTr2G3t0" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E4F4421567 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=oracle.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726871AbeHXOBy (ORCPT ); Fri, 24 Aug 2018 10:01:54 -0400 Received: from aserp2120.oracle.com ([141.146.126.78]:46404 "EHLO aserp2120.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726462AbeHXOBy (ORCPT ); Fri, 24 Aug 2018 10:01:54 -0400 Received: from pps.filterd (aserp2120.oracle.com [127.0.0.1]) by aserp2120.oracle.com (8.16.0.22/8.16.0.22) with SMTP id w7OAOmXQ169605; Fri, 24 Aug 2018 10:27:35 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : references : mime-version : content-type : in-reply-to; s=corp-2018-07-02; bh=xw9BLvZTOv+udwHSCVFPQjCzN1AaOvfb8sAEH2BgcBM=; b=cTr2G3t0GgOesgvy1TkNOfISlBeWFeg8ggah+XiUvKlSqKrdgdN5CuPTu6uW0ZGavF5w QjVOd58+nMHC9rXgUwUQtHYLWka+pBrTK6XHwEyePu+j8ZIxxrNXS+v1p2bUaodTPN8h iSKp1K3J1gDVeEn4cxaekCSSOkV5PNHxmypI/ytY5Zt1jQcCxWnt7s/YFwR+Jpk2S5au 9XRZtB5j5Eparff87H5pf0qgxr8fUm5DzUiiiA94/OBdfqe/LB6U+uFe+a3MosLzEG4c dCpDkajtkeT4bMM7ANAkRAOrnjH4ARma1g2rmnZaX7y69jFKViuNxn7wAuoXzRajkndc fA== Received: from aserv0022.oracle.com (aserv0022.oracle.com [141.146.126.234]) by aserp2120.oracle.com with ESMTP id 2kxbdqebu7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 24 Aug 2018 10:27:35 +0000 Received: from aserv0122.oracle.com (aserv0122.oracle.com [141.146.126.236]) by aserv0022.oracle.com (8.14.4/8.14.4) with ESMTP id w7OARX9R015311 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Fri, 24 Aug 2018 10:27:33 GMT Received: from abhmp0001.oracle.com (abhmp0001.oracle.com [141.146.116.7]) by aserv0122.oracle.com (8.14.4/8.14.4) with ESMTP id w7OARV6x014004; Fri, 24 Aug 2018 10:27:32 GMT Received: from mwanda (/197.232.248.111) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Fri, 24 Aug 2018 10:27:31 +0000 Date: Fri, 24 Aug 2018 13:27:24 +0300 From: Dan Carpenter To: Ding Xiang Cc: johan@kernel.org, elder@kernel.org, gregkh@linuxfoundation.org, greybus-dev@lists.linaro.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] staging: greybus: Fix null pointer dereference Message-ID: <20180824102723.zvzeaf26q6x7o3ms@mwanda> References: <1535083631-1892-1-git-send-email-dingxiang@cmss.chinamobile.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1535083631-1892-1-git-send-email-dingxiang@cmss.chinamobile.com> User-Agent: NeoMutt/20170609 (1.8.3) X-Proofpoint-Virus-Version: vendor=nai engine=5900 definitions=8994 signatures=668707 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 phishscore=0 bulkscore=0 spamscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1807170000 definitions=main-1808240113 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Aug 24, 2018 at 12:07:11AM -0400, Ding Xiang wrote: > If fw is null then fw->size will trigger null pointer dereference > > Signed-off-by: Ding Xiang > --- > drivers/staging/greybus/bootrom.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c > index e85ffae..3af28a0 100644 > --- a/drivers/staging/greybus/bootrom.c > +++ b/drivers/staging/greybus/bootrom.c > @@ -297,7 +297,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op) > > queue_work: > /* Refresh timeout */ > - if (!ret && (offset + size == fw->size)) > + if (!ret && fw && (offset + size == fw->size)) That is impossible. If "ret" is zero that implies "fw" is a valid pointer. regards, dan carpenter