On Mon, Mar 16, 2026 at 02:20:28AM +0800, Oarora Etimis wrote:
> In gb_bootrom_get_firmware(), the 'fw' pointer could be NULL if the
> function jumps to the 'unlock' label. The execution flow continues
> into the 'queue_work' block where 'fw->size' is accessed, leading to
> a null pointer dereference.
>
> Fix this by adding a NULL check for 'fw' before accessing its members.
>
> Signed-off-by: Oarora Etimis <OaroraEtimis@gmail.com>
> ---
>  drivers/staging/greybus/bootrom.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/greybus/bootrom.c b/drivers/staging/greybus/bootrom.c
> index 83921d90c322..50c80475d241 100644
> --- a/drivers/staging/greybus/bootrom.c
> +++ b/drivers/staging/greybus/bootrom.c
> @@ -298,7 +298,7 @@ static int gb_bootrom_get_firmware(struct gb_operation *op)
> 
>  queue_work:
>       /* Refresh timeout */
> -     if (!ret && (offset + size == fw->size))
> +     if (!ret && fw && (offset + size == fw->size))

Was this a static checker false positive?  Which checker are you using?

If fw is NULL then "ret" is a negative error code so the original code
is fine.

regards,
dan carpenter

>               next_request = NEXT_REQ_READY_TO_BOOT;
>       else
>               next_request = NEXT_REQ_GET_FIRMWARE;
> --
> 2.47.3
>