Received: by 2002:a25:e74b:0:0:0:0:0 with SMTP id e72csp505892ybh; Wed, 22 Jul 2020 06:17:19 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwldIhjghRhZh08R6LOb1vlVx01yiAV6x8rPrHmxrqxjC2fb+PctYafrIiwHOSv3v575DG0 X-Received: by 2002:a17:906:a253:: with SMTP id bi19mr28897343ejb.338.1595423839044; Wed, 22 Jul 2020 06:17:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1595423839; cv=none; d=google.com; s=arc-20160816; b=Ez/cZd7zf6RcYzgourPb389PDkS+rELC/kSuVR7krKuW2pJXVCuoWKKirbhDux5w8S Zrqpvs4Y8q9KnO1sfihCXEyx5ev1KnscegaQ4BFsgShEdm/eUzL4npxfOihxw9AjQijT giR9EME9Yqs9AqrV22SV9rmvKM8Ht9TWBNLAWo8vtH5/4lXfumKACkl0syFecsiPv1a2 fIkIr5abBOwqNoBaf7tkL403qUmSFjkPUoswGMypBIdQ+MHmwezcrhR/DrhIPbw8nUmS xzzSy0lxCdC3wBthR7dG+W7pNwPM2yK34dS4GSEy7ZoSDQIckR7sNh1h4h6tlJfz9Ufw 9uPw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:mail-followup-to :message-id:subject:cc:to:from:date; bh=l0pCvJYdrSl9n+K8JKDkMYAVFPIQvBgQIdy8Bx9FfTY=; b=C24yGBW/1hswRxBE5BK17IhGHi0/rZ85DmF/h/IX07XNtl4JWDV1NBJWvio/YWVhwz SiHTBs/UslhQm7jVqde+yKiVXsv1j7TqqcGz6WPv57AlWjk5k1I6oWDxQI+S+Npc8tUs p697EGXlb1xvCpd63YgTbx34z0PMzFctprm/GqgaYo+LI2bNgh+FAF29r8yew0aue9MD g0/hnPV5tocH3doTwkmUh44wV9HSV/fZ6VZNrFaRIFk1Cm5lpwLYdM8YtBtClR4Rc4i/ dg8t1g+jTXX75kbj5tZ1cqffAjDi3JmefIsy1JbzkcEp+d8+JBfBHWkfVIU+KTdTTbfI zWIw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y17si14756446ejk.677.2020.07.22.06.16.56; Wed, 22 Jul 2020 06:17:19 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732178AbgGVNQi (ORCPT + 99 others); Wed, 22 Jul 2020 09:16:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40296 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732158AbgGVNQh (ORCPT ); Wed, 22 Jul 2020 09:16:37 -0400 Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7219BC0619DE for ; Wed, 22 Jul 2020 06:16:37 -0700 (PDT) Received: from ptx.hi.pengutronix.de ([2001:67c:670:100:1d::c0]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jyEbn-0001NZ-KP; Wed, 22 Jul 2020 15:16:31 +0200 Received: from mtr by ptx.hi.pengutronix.de with local (Exim 4.92) (envelope-from ) id 1jyEbn-0004xj-7c; Wed, 22 Jul 2020 15:16:31 +0200 Date: Wed, 22 Jul 2020 15:16:31 +0200 From: Michael Tretter To: Colin King Cc: Pengutronix Kernel Team , Mauro Carvalho Chehab , Hans Verkuil , linux-media@vger.kernel.org, devel@driverdev.osuosl.org, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH][next][V2] media: allegro: fix potential null dereference on header Message-ID: <20200722131631.GA18419@pengutronix.de> Mail-Followup-To: Michael Tretter , Colin King , Pengutronix Kernel Team , Mauro Carvalho Chehab , Hans Verkuil , linux-media@vger.kernel.org, devel@driverdev.osuosl.org, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org References: <20200722130903.818041-1-colin.king@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20200722130903.818041-1-colin.king@canonical.com> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain X-Uptime: 15:12:53 up 153 days, 20:43, 131 users, load average: 0.09, 0.22, 0.19 User-Agent: Mutt/1.10.1 (2018-07-13) X-SA-Exim-Connect-IP: 2001:67c:670:100:1d::c0 X-SA-Exim-Mail-From: mtr@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-kernel@vger.kernel.org Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, 22 Jul 2020 14:09:03 +0100, Colin King wrote: > From: Colin Ian King > > The pointer header is an alias to msg and msg is being null checked. > However, if msg is null then header is also null and this can lead to > a null pointer dereference on the assignment type = header->type. Fix > this just using header->type after the null check and removing the need > for type as it is only used once. > > Addresses-Coverity: ("Dereference before null check") > Fixes: 3de16839669f ("media: allegro: add explicit mail encoding and decoding") > Signed-off-by: Colin Ian King Reviewed-by: Michael Tretter > --- > > V2: remove need for variable type, as suggested by Michael Tretter > > --- > drivers/staging/media/allegro-dvt/allegro-mail.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/drivers/staging/media/allegro-dvt/allegro-mail.c b/drivers/staging/media/allegro-dvt/allegro-mail.c > index 4ac65de12463..9286d2162377 100644 > --- a/drivers/staging/media/allegro-dvt/allegro-mail.c > +++ b/drivers/staging/media/allegro-dvt/allegro-mail.c > @@ -462,13 +462,12 @@ allegro_dec_encode_frame(struct mcu_msg_encode_frame_response *msg, u32 *src) > ssize_t allegro_encode_mail(u32 *dst, void *msg) > { > const struct mcu_msg_header *header = msg; > - enum mcu_msg_type type = header->type; > ssize_t size; > > if (!msg || !dst) > return -EINVAL; > > - switch (type) { > + switch (header->type) { > case MCU_MSG_TYPE_INIT: > size = allegro_enc_init(&dst[1], msg); > break; > -- > 2.27.0 > >