From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751588AbdFFKye (ORCPT <rfc822;w@1wt.eu>);
        Tue, 6 Jun 2017 06:54:34 -0400
Received: from muru.com ([72.249.23.125]:50550 "EHLO muru.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1751423AbdFFKyc (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 6 Jun 2017 06:54:32 -0400
Date: Tue, 6 Jun 2017 03:54:18 -0700
From: Tony Lindgren <tony@atomide.com>
To: Colin Ian King <colin.king@canonical.com>
Cc: Andrew Lunn <andrew@lunn.ch>, Florian Fainelli <f.fainelli@gmail.com>,
        netdev@vger.kernel.org,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: phy: cpcap-usb: Add CPCAP PMIC USB support
Message-ID: <20170606105418.GA3730@atomide.com>
References: <2ebfaf05-409b-f946-b2ad-f4e81c4439fa@canonical.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2ebfaf05-409b-f946-b2ad-f4e81c4439fa@canonical.com>
User-Agent: Mutt/1.8.2 (2017-04-18)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

* Colin Ian King <colin.king@canonical.com> [170605 10:58]:
> Hi Tony,
> 
> While running static analysis on linux-next, CoverityScan picked up a
> NULL pointer deference on ddata->pins when calling pinctrl_lookup_state:
> 
> 466        ddata->pins = devm_pinctrl_get(ddata->dev);
> 
>    1. Condition IS_ERR(ddata->pins), taking true branch.
> 
> 467        if (IS_ERR(ddata->pins)) {
> 468                dev_info(ddata->dev, "default pins not configured:
> %ld\n",
> 469                         PTR_ERR(ddata->pins));
> 
>    2. assign_zero: Assigning: ddata->pins = NULL.
> 
> 470                ddata->pins = NULL;
> 471        }
> 472
> 
>    CID 1440453 (#1 of 1): Explicit null dereferenced (FORWARD_NULL)3.
> var_deref_model: Passing null pointer ddata->pins to
> pinctrl_lookup_state, which dereferences it. [show details]
> 
> 473        ddata->pins_ulpi = pinctrl_lookup_state(ddata->pins, "ulpi");
> 
> 
> I suspect the IS_ERROR() check should return with some error return
> rather than continuing.

OK thanks for letting me know. I'll take a look and will
send a patch. The pinctrl_lookup_state() probably need to
happen only if ddata->pins as they are optional.

Regards,

Tony