In gb_bootrom_get_firmware(), the 'fw' pointer could be NULL if the
function jumps to the 'unlock' label. The execution flow continues
into the 'queue_work' block where 'fw->size' is accessed, leading to
a null pointer dereference.
Fix this by adding a NULL check for 'fw' before accessing its members.
Signed-off-by: Oarora Etimis <OaroraEtimis(a)gmail.com>
---
drivers/staging/greybus/bootrom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
index 83921d90c322..50c80475d241 100644
--- a/drivers/staging/greybus/bootrom.c
+++ b/drivers/staging/greybus/bootrom.c
@@ -298,7 +298,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
queue_work:
/* Refresh timeout */
- if (!ret && (offset + size == fw->size))
+ if (!ret && fw && (offset + size == fw->size))
next_request = NEXT_REQ_READY_TO_BOOT;
else
next_request = NEXT_REQ_GET_FIRMWARE;
--
2.47.3
In gb_bootrom_get_firmware(), the 'fw' pointer could be NULL if the
function jumps to the 'unlock' label. The execution flow continues
into the 'queue_work' block where 'fw->size' is accessed, leading to
a null pointer dereference.
Fix this by adding a NULL check for 'fw' before accessing its members.
Signed-off-by: Oarora Etimis <OaroraEtimis(a)gmail.com>
---
Changes in v2:
- Rebased onto the latest staging-next branch to resolve merge conflicts.
- No logical code changes.
drivers/staging/greybus/bootrom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
index 83921d90c322..50c80475d241 100644
--- a/drivers/staging/greybus/bootrom.c
+++ b/drivers/staging/greybus/bootrom.c
@@ -298,7 +298,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
queue_work:
/* Refresh timeout */
- if (!ret && (offset + size == fw->size))
+ if (!ret && fw && (offset + size == fw->size))
next_request = NEXT_REQ_READY_TO_BOOT;
else
next_request = NEXT_REQ_GET_FIRMWARE;
--
2.47.3
The gb_dev_loopback_ro_attr macro accepted a 'conn' argument which
was never used in its expansion. Remove it from both the macro
definition and its invocation.
Signed-off-by: Giacomo Di Clerico <giacomodiclerico(a)gmail.com>
---
drivers/staging/greybus/loopback.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/greybus/loopback.c b/drivers/staging/greybus/loopback.c
index aa9c73cb0ae5..855d5051c55d 100644
--- a/drivers/staging/greybus/loopback.c
+++ b/drivers/staging/greybus/loopback.c
@@ -193,7 +193,7 @@ static ssize_t field##_store(struct device *dev, \
} \
static DEVICE_ATTR_RW(field)
-#define gb_dev_loopback_ro_attr(field, conn) \
+#define gb_dev_loopback_ro_attr(field) \
static ssize_t field##_show(struct device *dev, \
struct device_attribute *attr, \
char *buf) \
@@ -305,7 +305,7 @@ gb_dev_loopback_rw_attr(us_wait, d);
/* Maximum iterations for a given operation: 1-(2^32-1), 0 implies infinite */
gb_dev_loopback_rw_attr(iteration_max, u);
/* The current index of the for (i = 0; i < iteration_max; i++) loop */
-gb_dev_loopback_ro_attr(iteration_count, false);
+gb_dev_loopback_ro_attr(iteration_count);
/* A flag to indicate synchronous or asynchronous operations */
gb_dev_loopback_rw_attr(async, u);
/* Timeout of an individual asynchronous request */
--
2.53.0
Remove redundant 'int' keyword from 'unsigned long long int' type cast.
'unsigned long long' and 'unsigned long long int' are identical types
in C. Prefer the shorter form as suggested by checkpatch.pl --strict.
Signed-off-by: Tomasz Unger <tomasz.unger(a)yahoo.pl>
---
drivers/staging/greybus/Documentation/firmware/authenticate.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/Documentation/firmware/authenticate.c b/drivers/staging/greybus/Documentation/firmware/authenticate.c
index 3d2c6f88a138..0ef88b7d24de 100644
--- a/drivers/staging/greybus/Documentation/firmware/authenticate.c
+++ b/drivers/staging/greybus/Documentation/firmware/authenticate.c
@@ -58,7 +58,7 @@ int main(int argc, char *argv[])
goto close_fd;
}
- printf("UID received: 0x%llx\n", *(unsigned long long int *)(uid.uid));
+ printf("UID received: 0x%llx\n", *(unsigned long long *)(uid.uid));
/* Get certificate */
printf("Get IMS certificate\n");
---
base-commit: 6ae79e7736ee6a5f920867e5346d8a106cd1db74
change-id: 20260305-greybus-unsigned-long-long-e7465302d3fa
Best regards,
--
Tomasz Unger <tomasz.unger(a)yahoo.pl>