Coverity: btusb_work(): Null pointer dereferences

DISCUSSION coverity-bot 2 participants 4 messages Apr 6, 2020 – Apr 8, 2020 Linux-next tree

Share & tools

coverity-bot

author

2020-04-06 15:49 UTC #0 lore raw

Hello!

This is an experimental automated report about issues detected by Coverity from a scan of next-20200406 as part of the linux-next weekly scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan

You're getting this email because you were associated with the identified lines of code (noted below) that were touched by recent commits:

baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")

Coverity reported the following:

*** CID 1492498: Null pointer dereferences (FORWARD_NULL) /drivers/bluetooth/btusb.c: 1665 in btusb_work()
1659 }
1660 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
1661
1662 data->usb_alt6_packet_flow = true;
1663
1664 /* Check if Alt 6 is supported for Transparent audio */
vvv CID 1492498: Null pointer dereferences (FORWARD_NULL)
vvv Passing "data" to "btusb_find_altsetting", which dereferences null "data->isoc".

1665     			if (btusb_find_altsetting(data, 6))
1666     				new_alts = 6;
1667     			else
1668     				bt_dev_err(hdev, "Device does not support ALT setting 6");
1669     		}

1670

If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first):

Reported-by coverity-bot <[email protected]>

Addresses-Coverity-ID: 1492498 ("Null pointer dereferences")

Fixes baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")

Thanks for your attention!

Signature · 1 line

Coverity-bot

Narasimman, Sathish

2020-04-07 10:54 UTC #1 lore raw

I think this is False Positive.

In the function btusb_probe the memory allocation is happened and verified for NULL. I don't this so checking for NULL evey time is required.

Sample code snip

In function "btusb_probe"

{
        data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
        if (!data)
                return -ENOMEM;
....
       INIT_WORK(&data->work, btusb_work);

}

Regards
Sathish N

-----Original Message-----
From: coverity-bot <[email protected]>
Sent: Monday, April 6, 2020 9:20 PM
To: Narasimman, Sathish <[email protected]>
Cc: Marcel Holtmann <[email protected]>; Tumkur Narayan, Chethan <[email protected]>; lkp <[email protected]>; Bag, Amit K <[email protected]>; Hsin-Yu Chao <[email protected]>; Hedberg, Johan <[email protected]>; Gustavo A. R. Silva <[email protected]>; [email protected]
Subject: Coverity: btusb_work(): Null pointer dereferences

Hello!

You're getting this email because you were associated with the identified lines of code (noted below) that were touched by recent commits:

baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")

Coverity reported the following:

1665     			if (btusb_find_altsetting(data, 6))
1666     				new_alts = 6;
1667     			else
1668     				bt_dev_err(hdev, "Device does not support ALT setting 6");
1669     		}

1670

Reported-by coverity-bot <[email protected]>

Addresses-Coverity-ID: 1492498 ("Null pointer dereferences")

Fixes baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")

Thanks for your attention!

--
Coverity-bot

Kees Cook

author

2020-04-07 18:14 UTC #2 lore raw

Quoted 10 lines · Sathish

Hi
I think this is False Positive.
In the function btusb_probe the memory allocation is happened and verified for NULL. I don't this so checking for NULL evey time is required.
Sample code snip
In function "btusb_probe"

Quoted 8 lines

{
        data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
        if (!data)
                return -ENOMEM;
....
       INIT_WORK(&data->work, btusb_work);

}

This warning is talking about data->isoc, which is checked for NULL in other places before the call to btusb_find_altsetting(), which doesn't check for NULL.

-Kees

Quoted 51 lines

Regards
Sathish N
-----Original Message-----
From: coverity-bot <[email protected]>
Sent: Monday, April 6, 2020 9:20 PM
To: Narasimman, Sathish <[email protected]>
Cc: Marcel Holtmann <[email protected]>; Tumkur Narayan, Chethan <[email protected]>; lkp <[email protected]>; Bag, Amit K <[email protected]>; Hsin-Yu Chao <[email protected]>; Hedberg, Johan <[email protected]>; Gustavo A. R. Silva <[email protected]>; [email protected]
Subject: Coverity: btusb_work(): Null pointer dereferences
Hello!
This is an experimental automated report about issues detected by Coverity from a scan of next-20200406 as part of the linux-next weekly scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan
You're getting this email because you were associated with the identified lines of code (noted below) that were touched by recent commits:
baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")
Coverity reported the following:
*** CID 1492498: Null pointer dereferences (FORWARD_NULL) /drivers/bluetooth/btusb.c: 1665 in btusb_work()
1659 }
1660 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
1661
1662 data->usb_alt6_packet_flow = true;
1663
1664 /* Check if Alt 6 is supported for Transparent audio */
vvv CID 1492498: Null pointer dereferences (FORWARD_NULL)
vvv Passing "data" to "btusb_find_altsetting", which dereferences null "data->isoc".
1665     			if (btusb_find_altsetting(data, 6))
1666     				new_alts = 6;
1667     			else
1668     				bt_dev_err(hdev, "Device does not support ALT setting 6");
1669     		}
1670
If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first):
Reported-by coverity-bot <[email protected]>
Addresses-Coverity-ID: 1492498 ("Null pointer dereferences")
Fixes baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")
Thanks for your attention!
--
Coverity-bot

Signature · 1 line

Kees Cook

Narasimman, Sathish

2020-04-08 07:38 UTC #3 lore raw

Respective Fix for this updated and merged in Bluetooth-next.

Thanks
Sathish N

-----Original Message-----
From: Kees Cook <[email protected]>
Sent: Tuesday, April 7, 2020 11:44 PM
To: Narasimman, Sathish <[email protected]>
Cc: Marcel Holtmann <[email protected]>; Tumkur Narayan, Chethan <[email protected]>; lkp <[email protected]>; Bag, Amit K <[email protected]>; Hsin-Yu Chao <[email protected]>; Hedberg, Johan <[email protected]>; Gustavo A. R. Silva <[email protected]>; [email protected]
Subject: Re: Coverity: btusb_work(): Null pointer dereferences

Quoted 10 lines · Sathish

Hi
I think this is False Positive.
In the function btusb_probe the memory allocation is happened and verified for NULL. I don't this so checking for NULL evey time is required.
Sample code snip
In function "btusb_probe"

Quoted 8 lines

{
        data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
        if (!data)
                return -ENOMEM;
....
       INIT_WORK(&data->work, btusb_work);

}

This warning is talking about data->isoc, which is checked for NULL in other places before the call to btusb_find_altsetting(), which doesn't check for NULL.

-Kees

Quoted 49 lines

Regards
Sathish N
-----Original Message-----
From: coverity-bot <[email protected]>
Sent: Monday, April 6, 2020 9:20 PM
To: Narasimman, Sathish <[email protected]>
Cc: Marcel Holtmann <[email protected]>; Tumkur Narayan, Chethan <[email protected]>; lkp <[email protected]>; Bag, Amit K <[email protected]>; Hsin-Yu Chao <[email protected]>; Hedberg, Johan <[email protected]>; Gustavo A. R. Silva <[email protected]>; [email protected]
Subject: Coverity: btusb_work(): Null pointer dereferences
Hello!
This is an experimental automated report about issues detected by Coverity from a scan of next-20200406 as part of the linux-next weekly scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan
You're getting this email because you were associated with the identified lines of code (noted below) that were touched by recent commits:
baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")
Coverity reported the following:
*** CID 1492498: Null pointer dereferences (FORWARD_NULL) /drivers/bluetooth/btusb.c: 1665 in btusb_work()
1659 }
1660 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
1661
1662 data->usb_alt6_packet_flow = true;
1663
1664 /* Check if Alt 6 is supported for Transparent audio */
vvv CID 1492498: Null pointer dereferences (FORWARD_NULL)
vvv Passing "data" to "btusb_find_altsetting", which dereferences null "data->isoc".
1665     			if (btusb_find_altsetting(data, 6))
1666     				new_alts = 6;
1667     			else
1668     				bt_dev_err(hdev, "Device does not support ALT setting 6");
1669     		}
1670
If this is a false positive, please let us know so we can mark it as such, or teach the Coverity rules to be smarter. If not, please make sure fixes get into linux-next. :) For patches fixing this, please include these lines (but double-check the "Fixes" first):
Reported-by coverity-bot <[email protected]>
Addresses-Coverity-ID: 1492498 ("Null pointer dereferences")

Quoted 8 lines

Fixes baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB
Endpoints")
Thanks for your attention!
--
Coverity-bot

--
Kees Cook