From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.5 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2286C433E4 for ; Wed, 22 Jul 2020 13:00:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 955BB20729 for ; Wed, 22 Jul 2020 13:00:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732449AbgGVNAh (ORCPT ); Wed, 22 Jul 2020 09:00:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37826 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726525AbgGVNAf (ORCPT ); Wed, 22 Jul 2020 09:00:35 -0400 Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38A38C0619DC for ; Wed, 22 Jul 2020 06:00:35 -0700 (PDT) Received: from ptx.hi.pengutronix.de ([2001:67c:670:100:1d::c0]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jyEMF-0007sw-P8; Wed, 22 Jul 2020 15:00:27 +0200 Received: from mtr by ptx.hi.pengutronix.de with local (Exim 4.92) (envelope-from ) id 1jyEMD-0002xc-D3; Wed, 22 Jul 2020 15:00:25 +0200 Date: Wed, 22 Jul 2020 15:00:25 +0200 From: Michael Tretter To: Colin King Cc: Pengutronix Kernel Team , Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , linux-media@vger.kernel.org, devel@driverdev.osuosl.org, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH][next] media: allegro: fix potential null dereference on header Message-ID: <20200722130025.GA21264@pengutronix.de> Mail-Followup-To: Michael Tretter , Colin King , Pengutronix Kernel Team , Mauro Carvalho Chehab , Greg Kroah-Hartman , Hans Verkuil , linux-media@vger.kernel.org, devel@driverdev.osuosl.org, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org References: <20200720163804.340047-1-colin.king@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20200720163804.340047-1-colin.king@canonical.com> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain X-Uptime: 14:53:31 up 153 days, 20:24, 131 users, load average: 0.03, 0.11, 0.09 User-Agent: Mutt/1.10.1 (2018-07-13) X-SA-Exim-Connect-IP: 2001:67c:670:100:1d::c0 X-SA-Exim-Mail-From: mtr@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-kernel@vger.kernel.org Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 20 Jul 2020 17:38:04 +0100, Colin King wrote: > From: Colin Ian King > > The pointer header is an alias to msg and msg is being null checked. > However, if msg is null then header is also null and this can lead to > a null pointer dereference on the assignment type = header->type. Fix > this by only dereferencing header after the null check on msg. > > Addresses-Coverity: ("Dereference before null check") > Fixes: 3de16839669f ("media: allegro: add explicit mail encoding and decoding") > Signed-off-by: Colin Ian King > --- > drivers/staging/media/allegro-dvt/allegro-mail.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/staging/media/allegro-dvt/allegro-mail.c b/drivers/staging/media/allegro-dvt/allegro-mail.c > index 4ac65de12463..4496e2a4da5c 100644 > --- a/drivers/staging/media/allegro-dvt/allegro-mail.c > +++ b/drivers/staging/media/allegro-dvt/allegro-mail.c > @@ -462,12 +462,14 @@ allegro_dec_encode_frame(struct mcu_msg_encode_frame_response *msg, u32 *src) > ssize_t allegro_encode_mail(u32 *dst, void *msg) > { > const struct mcu_msg_header *header = msg; > - enum mcu_msg_type type = header->type; > + enum mcu_msg_type type; > ssize_t size; > > if (!msg || !dst) > return -EINVAL; > > + type = header->type; type is only used in the switch statement right below the assignment. Thus, you could remove the local variable and directly use header->type in the switch. Michael > + > switch (type) { > case MCU_MSG_TYPE_INIT: > size = allegro_enc_init(&dst[1], msg); > -- > 2.27.0 > >