From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4695CC433FB for ; Mon, 20 Jul 2020 16:38:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2C3652176B for ; Mon, 20 Jul 2020 16:38:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389025AbgGTQiK (ORCPT ); Mon, 20 Jul 2020 12:38:10 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:44993 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729269AbgGTQiI (ORCPT ); Mon, 20 Jul 2020 12:38:08 -0400 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1jxYnk-00007X-BL; Mon, 20 Jul 2020 16:38:04 +0000 From: Colin King To: Michael Tretter , Pengutronix Kernel Team , Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , linux-media@vger.kernel.org, devel@driverdev.osuosl.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH][next] media: allegro: fix potential null dereference on header Date: Mon, 20 Jul 2020 17:38:04 +0100 Message-Id: <20200720163804.340047-1-colin.king@canonical.com> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King The pointer header is an alias to msg and msg is being null checked. However, if msg is null then header is also null and this can lead to a null pointer dereference on the assignment type = header->type. Fix this by only dereferencing header after the null check on msg. Addresses-Coverity: ("Dereference before null check") Fixes: 3de16839669f ("media: allegro: add explicit mail encoding and decoding") Signed-off-by: Colin Ian King --- drivers/staging/media/allegro-dvt/allegro-mail.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/allegro-dvt/allegro-mail.c b/drivers/staging/media/allegro-dvt/allegro-mail.c index 4ac65de12463..4496e2a4da5c 100644 --- a/drivers/staging/media/allegro-dvt/allegro-mail.c +++ b/drivers/staging/media/allegro-dvt/allegro-mail.c @@ -462,12 +462,14 @@ allegro_dec_encode_frame(struct mcu_msg_encode_frame_response *msg, u32 *src) ssize_t allegro_encode_mail(u32 *dst, void *msg) { const struct mcu_msg_header *header = msg; - enum mcu_msg_type type = header->type; + enum mcu_msg_type type; ssize_t size; if (!msg || !dst) return -EINVAL; + type = header->type; + switch (type) { case MCU_MSG_TYPE_INIT: size = allegro_enc_init(&dst[1], msg); -- 2.27.0