The Linux Kernel Mailing List
 help / color / mirror / Atom feed
From: Markus Elfring <Markus.Elfring@web.de>
To: driver-core@lists.linux.dev, "Danilo Krummrich" <dakr@kernel.org>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	"Jonathan Cameron" <jic23@kernel.org>,
	"Lyude Paul" <lyude@redhat.com>,
	"Rafael J. Wysocki" <rafael@kernel.org>,
	"Thomas Weißschuh" <thomas.weissschuh@linutronix.de>,
	"Zijun Hu" <quic_zijuhu@quicinc.com>
Cc: LKML <linux-kernel@vger.kernel.org>, kernel-janitors@vger.kernel.org
Subject: [PATCH] driver core: faux: Move a variable assignment behind a condition check in faux_device_destroy()
Date: Sun, 12 Jul 2026 15:56:09 +0200	[thread overview]
Message-ID: <1fe66c80-dfa5-4ef1-aec0-8f7fc3f2fe21@web.de> (raw)

From: Markus Elfring <elfring@users.sourceforge.net>
Date: Sun, 12 Jul 2026 15:45:19 +0200

The address of a data structure member was determined before
a corresponding null pointer check in the implementation of
the function “faux_device_destroy”.

Thus avoid the risk for undefined behaviour by moving the assignment
for the variable “dev” behind a condition check.

This issue was detected by using the Coccinelle software.

Fixes: 35fa2d88ca9481e5caf533d58b99ca259c63b2fe ("driver core: add a faux bus for use when a simple device/bus is needed")
Cc: stable@vger.kernel.org
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
---
 drivers/base/faux.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/base/faux.c b/drivers/base/faux.c
index a8329f88222e..4eb22d082552 100644
--- a/drivers/base/faux.c
+++ b/drivers/base/faux.c
@@ -221,11 +221,12 @@ EXPORT_SYMBOL_GPL(faux_device_create);
  */
 void faux_device_destroy(struct faux_device *faux_dev)
 {
-	struct device *dev = &faux_dev->dev;
+	struct device *dev;
 
 	if (!faux_dev)
 		return;
 
+	dev = &faux_dev->dev;
 	device_del(dev);
 
 	/* The final put_device() will clean up the memory we allocated for this device. */
-- 
2.55.0


             reply	other threads:[~2026-07-12 13:56 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-12 13:56 Markus Elfring [this message]
2026-07-12 14:09 ` [PATCH] driver core: faux: Move a variable assignment behind a condition check in faux_device_destroy() Greg Kroah-Hartman
2026-07-12 16:23   ` Markus Elfring
2026-07-12 16:39     ` Greg Kroah-Hartman
2026-07-12 16:54       ` Markus Elfring

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1fe66c80-dfa5-4ef1-aec0-8f7fc3f2fe21@web.de \
    --to=markus.elfring@web.de \
    --cc=dakr@kernel.org \
    --cc=driver-core@lists.linux.dev \
    --cc=gregkh@linuxfoundation.org \
    --cc=jic23@kernel.org \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lyude@redhat.com \
    --cc=quic_zijuhu@quicinc.com \
    --cc=rafael@kernel.org \
    --cc=thomas.weissschuh@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox