Yes, it was a false positive from Clang (make LLVM=1). I will drop the patch. Thanks, Oarora
On Mon, Mar 16, 2026, 16:58 Dan Carpenter dan.carpenter@linaro.org wrote:
On Mon, Mar 16, 2026 at 02:20:28AM +0800, Oarora Etimis wrote:
In gb_bootrom_get_firmware(), the 'fw' pointer could be NULL if the function jumps to the 'unlock' label. The execution flow continues into the 'queue_work' block where 'fw->size' is accessed, leading to a null pointer dereference.
Fix this by adding a NULL check for 'fw' before accessing its members.
Signed-off-by: Oarora Etimis OaroraEtimis@gmail.com
drivers/staging/greybus/bootrom.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/greybus/bootrom.c
b/drivers/staging/greybus/bootrom.c
index 83921d90c322..50c80475d241 100644 --- a/drivers/staging/greybus/bootrom.c +++ b/drivers/staging/greybus/bootrom.c @@ -298,7 +298,7 @@ static int gb_bootrom_get_firmware(struct
gb_operation *op)
queue_work: /* Refresh timeout */
if (!ret && (offset + size == fw->size))
if (!ret && fw && (offset + size == fw->size))Was this a static checker false positive? Which checker are you using?
If fw is NULL then "ret" is a negative error code so the original code is fine.
regards, dan carpenter
next_request = NEXT_REQ_READY_TO_BOOT; else next_request = NEXT_REQ_GET_FIRMWARE;-- 2.47.3