[greybus-dev] Re: Unitialized Variable and Null Pointer Dereference bug in gb_bootrom_get_firmware

On 21-06-22, 16:40, Johan Hovold wrote:

On Tue, Jun 21, 2022 at 10:36:04PM +0800, Dongliang Mu wrote:

...

Hi maintainers,

I would like to send one bug report.

In gb_bootrom_get_firmware, if the first branch is satisfied, it will go to queue_work, leading to the dereference of uninitialized const variable "fw". If the second branch is satisfied, it will go to unlock with fw as NULL pointer, leading to a NULL Pointer Dereference.

This sounds like the false positive that checkers keep tripping over.

Please double check your analysis and search the archives first.

And everytime I get this report, I wonder if I should change the code to be a bit simpler :)