From: Johan Hovold <johan@kernel.org>
To: Marinela Tatiana Selseth <marinela.selseth@firmwaredesign.org>
Cc: vaibhav.sr@gmail.com, mgreer@animalcreek.com, elder@kernel.org,
gregkh@linuxfoundation.org, greybus-dev@lists.linaro.org,
linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] staging: greybus: bootrom: fix null pointer dereference in get_firmware
Date: Mon, 5 Oct 2026 10:22:42 +0200 [thread overview]
Message-ID: <asNeUn4qLLLMrjYX@hovoldconsulting.com> (raw)
In-Reply-To: <20261005063454.95647-1-marinela.selseth@firmwaredesign.org>
On Mon, Oct 05, 2026 at 01:34:54AM -0500, Marinela Tatiana Selseth wrote:
> Automated static analysis via Coccinelle uncovered a potential null
> pointer dereference and uninitialized stack pointer vulnerability
> inside gb_bootrom_get_firmware().
Please check the archives to see why coccinelle is wrong.
> The routine evaluates whether a firmware transmission sequence is
> complete at its trailing 'queue_work:' label by checking if the
> transfer bounds match 'fw->size'.
> When this label is reached the 'fw' can be uninitialized or NULL.
> Both scenarios expose the kernel to critical memory faults or null
> pointer panics.
>
> Fix these dual vulnerability paths by initializing the 'fw' pointer
> to NULL at its top-level definition block and introducing an
> explicit short-circuit guard condition to safely gate the
> trailing size evaluation.
>
> Assisted-by: Gemini
Also, LLM assisted patches are rejected for staging (again, see the
archives).
> Signed-off-by: Marinela Tatiana Selseth <marinela.selseth@firmwaredesign.org>
Johan
prev parent reply other threads:[~2026-10-05 8:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-05 6:34 [PATCH] staging: greybus: bootrom: fix null pointer dereference in get_firmware Marinela Tatiana Selseth
2026-10-05 8:22 ` Johan Hovold [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=asNeUn4qLLLMrjYX@hovoldconsulting.com \
--to=johan@kernel.org \
--cc=elder@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=greybus-dev@lists.linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-staging@lists.linux.dev \
--cc=marinela.selseth@firmwaredesign.org \
--cc=mgreer@animalcreek.com \
--cc=vaibhav.sr@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.