[cris:scmi_telemetry_ng_V10 21/24] drivers/firmware/arm_scmi/scmi_system_telemetry.c:430:30: sparse: sparse: Using plain integer as NULL pointer

[cris:scmi_telemetry_ng_V10 21/24] drivers/firmware/arm_scmi/scmi_system_telemetry.c:430:30: sparse: sparse: Using plain integer as NULL pointer

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/cris/linux.git scmi_telemetry_ng_V10
head:   df0b7741c5c054f77c494b8a0a33fedba6a1a379
commit: 587d35c2f0b836fec2a46729ecd0532d65689921 [21/24] firmware: arm_scmi: Add System Telemetry driver
config: powerpc64-randconfig-r113-20260817 (https://download.01.org/0day-ci/archive/20260817/202608172008.fMZdQvug-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 15.2.0
sparse: v0.6.5-rc1
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260817/202608172008.fMZdQvug-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608172008.fMZdQvug-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
>> drivers/firmware/arm_scmi/scmi_system_telemetry.c:430:30: sparse: sparse: Using plain integer as NULL pointer

vim +430 drivers/firmware/arm_scmi/scmi_system_telemetry.c

   408	
   409	static int
   410	scmi_tlm_batch_initialize(void __user *uptr, struct scmi_tlm_batch *batch,
   411				  size_t item_sz, unsigned int max_items,
   412				  void **out_items, size_t *out_batch_sz,
   413				  int **out_states, size_t *out_states_sz)
   414	{
   415		size_t batch_sz;
   416	
   417		if (copy_from_user(batch, uptr, sizeof(*batch)))
   418			return -EFAULT;
   419	
   420		if (batch->reserved || batch->item_sz != item_sz ||
   421		    batch->num_items > max_items)
   422			return -EINVAL;
   423	
   424		/* Sanity check on user invocation */
   425		if (!out_items || !out_batch_sz)
   426			return -EINVAL;
   427	
   428		/* Was a size query ? */
   429		if (batch->num_items == 0) {
 > 430			*out_items = 0;
   431			*out_batch_sz = 0;
   432			return 0;
   433		}
   434	
   435		batch_sz = array_size(batch->num_items, batch->item_sz);
   436		if (batch_sz == SIZE_MAX)
   437			return -EOVERFLOW;
   438	
   439		void *items __free(kvfree) = kvzalloc(batch_sz, GFP_KERNEL);
   440		if (!items)
   441			return -ENOMEM;
   442	
   443		/* Read all the requested configs */
   444		if (copy_from_user(items, u64_to_user_ptr(batch->items), batch_sz))
   445			return -EFAULT;
   446	
   447		/* Is per-read status required ? */
   448		if (batch->states) {
   449			size_t states_sz;
   450	
   451			states_sz = array_size(batch->num_items, sizeof(int));
   452			if (states_sz == SIZE_MAX)
   453				return -EOVERFLOW;
   454	
   455			int *states_arr __free(kvfree) = kvzalloc(states_sz, GFP_KERNEL);
   456			if (!states_arr)
   457				return -ENOMEM;
   458	
   459			if (copy_from_user(states_arr, u64_to_user_ptr(batch->states),
   460					   states_sz))
   461				return -EFAULT;
   462	
   463			if (out_states)
   464				*out_states = no_free_ptr(states_arr);
   465			if (out_states_sz)
   466				*out_states_sz = states_sz;
   467		} else {
   468			if (out_states)
   469				*out_states = NULL;
   470			if (out_states_sz)
   471				*out_states_sz = 0;
   472		}
   473	
   474		*out_items = no_free_ptr(items);
   475		*out_batch_sz = batch_sz;
   476	
   477		return 0;
   478	}
   479	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki