`find_gmin_subdev` function that returns a pointer to `struct gmin_subdev` can return NULL. In `gmin_v2p8_ctrl` there's a call to this function but the possibility of a NULL was not checked before its being dereferenced. ie: ``` /* Acquired here --------v */ struct gmin_subdev *gs = find_gmin_subdev(subdev); int ret; int value; /* v------Dereferenced here */ if (gs->v2p8_gpio >= 0) { pr_info("atomisp_gmin_platform: 2.8v power on GPIO %d\n", gs->v2p8_gpio); ret = gpio_request(gs->v2p8_gpio, "camera_v2p8"); if (!ret) ret = gpio_direction_output(gs->v2p8_gpio, 0); if (ret) pr_err("V2P8 GPIO initialization failed\n"); } ``` I have moved the NULL check before deref point. Caught-by: Coverity Static Analyzer CID 1465536 Signed-off-by: Cengiz Can <cengiz@xxxxxxxxxx> --- drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c index 0df46a1af5f0..8e9c5016f299 100644 --- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c @@ -871,6 +871,11 @@ static int gmin_v2p8_ctrl(struct v4l2_subdev *subdev, int on) int ret; int value; + if (!gs) { + pr_err("Unable to find gmin subdevice\n"); + return -EINVAL; + } + if (gs->v2p8_gpio >= 0) { pr_info("atomisp_gmin_platform: 2.8v power on GPIO %d\n", gs->v2p8_gpio); @@ -881,7 +886,7 @@ static int gmin_v2p8_ctrl(struct v4l2_subdev *subdev, int on) pr_err("V2P8 GPIO initialization failed\n"); } - if (!gs || gs->v2p8_on == on) + if (gs->v2p8_on == on) return 0; gs->v2p8_on = on; -- 2.27.0 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel