drivers/bluetooth/btintel_pcie.c:386 btintel_pcie_recv_frame() warn: variable dereferenced before check 'data' (see line 380)
From: Dan Carpenter
Date: Thu May 23 2024 - 08:30:53 EST
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: ea5f6ad9ad9645733b72ab53a98e719b460d36a6
commit: 6e65a09f927566f257322358d429b267548473eb Bluetooth: btintel_pcie: Add *setup* function to download firmware
config: alpha-randconfig-r081-20240516 (https://download.01.org/0day-ci/archive/20240517/202405170424.97VIwnBn-lkp@xxxxxxxxx/config)
compiler: alpha-linux-gcc (GCC) 13.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
| Closes: https://lore.kernel.org/r/202405170424.97VIwnBn-lkp@xxxxxxxxx/
smatch warnings:
drivers/bluetooth/btintel_pcie.c:386 btintel_pcie_recv_frame() warn: variable dereferenced before check 'data' (see line 380)
vim +/data +386 drivers/bluetooth/btintel_pcie.c
6e65a09f927566 Kiran K 2024-05-07 371 static int btintel_pcie_recv_frame(struct btintel_pcie_data *data,
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 372 struct sk_buff *skb)
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 373 {
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 374 int ret;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 375 u8 pkt_type;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 376 u16 plen;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 377 u32 pcie_pkt_type;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 378 struct sk_buff *new_skb;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 379 void *pdata;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 @380 struct hci_dev *hdev = data->hdev;
^^^^^^^^^^
data dereferenced
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 381
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 382 spin_lock(&data->hci_rx_lock);
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 383
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 384 /* The first 4 bytes indicates the Intel PCIe specific packet type */
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 385 pdata = skb_pull_data(skb, BTINTEL_PCIE_HCI_TYPE_LEN);
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 @386 if (!data) {
^^^^^
Presumably this was supposed to check "pdata".
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 387 bt_dev_err(hdev, "Corrupted packet received");
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 388 ret = -EILSEQ;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 389 goto exit_error;
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 390 }
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 391
c2b636b3f788d1 Tedd Ho-Jeong An 2024-05-07 392 pcie_pkt_type = get_unaligned_le32(pdata);
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki