tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

wifi: brcmfmac: Fix error pointer dereference

The function brcmf_chip_add_core() can return an error pointer and is
not checked. Add checks for error pointer.

Detected by Smatch:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

Fixes: cb7cf7be9eba7 ("brcmfmac: make chip related functions host interface independent")
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260217023043.73631-1-ethantidmore06@gmail.com
[add missing wifi: prefix]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

authored by

Ethan Tidmore and committed by
Johannes Berg dd8592fc 014eec31

+15
+15
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
··· 1007 1007 1008 1008 core = brcmf_chip_add_core(ci, BCMA_CORE_CHIPCOMMON, 1009 1009 SI_ENUM_BASE_DEFAULT, 0); 1010 + if (IS_ERR(core)) 1011 + return PTR_ERR(core); 1012 + 1010 1013 brcmf_chip_sb_corerev(ci, core); 1011 1014 core = brcmf_chip_add_core(ci, BCMA_CORE_SDIO_DEV, 1012 1015 BCM4329_CORE_BUS_BASE, 0); 1016 + if (IS_ERR(core)) 1017 + return PTR_ERR(core); 1018 + 1013 1019 brcmf_chip_sb_corerev(ci, core); 1014 1020 core = brcmf_chip_add_core(ci, BCMA_CORE_INTERNAL_MEM, 1015 1021 BCM4329_CORE_SOCRAM_BASE, 0); 1022 + if (IS_ERR(core)) 1023 + return PTR_ERR(core); 1024 + 1016 1025 brcmf_chip_sb_corerev(ci, core); 1017 1026 core = brcmf_chip_add_core(ci, BCMA_CORE_ARM_CM3, 1018 1027 BCM4329_CORE_ARM_BASE, 0); 1028 + if (IS_ERR(core)) 1029 + return PTR_ERR(core); 1030 + 1019 1031 brcmf_chip_sb_corerev(ci, core); 1020 1032 1021 1033 core = brcmf_chip_add_core(ci, BCMA_CORE_80211, 0x18001000, 0); 1034 + if (IS_ERR(core)) 1035 + return PTR_ERR(core); 1036 + 1022 1037 brcmf_chip_sb_corerev(ci, core); 1023 1038 } else if (socitype == SOCI_AI) { 1024 1039 ci->iscoreup = brcmf_chip_ai_iscoreup;