Return value of 'tb_switch_find_port' has to be checked to avoid null pointer dereferences in functions tb_tunnel_alloc_dma() and tb_port_info(). Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 386e5e29d81c ("thunderbolt: Make tb_find_port() available to other files") Signed-off-by: Natalia Petrova <n.petrova@xxxxxxxxxx> --- drivers/thunderbolt/tb.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c index 9853f6c7e81d..5d6cded68d46 100644 --- a/drivers/thunderbolt/tb.c +++ b/drivers/thunderbolt/tb.c @@ -1156,6 +1156,8 @@ static int tb_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd, sw = tb_to_switch(xd->dev.parent); dst_port = tb_port_at(xd->route, sw); nhi_port = tb_switch_find_port(tb->root_switch, TB_TYPE_NHI); + if (!nhi_port) + return -EIO; mutex_lock(&tb->lock); tunnel = tb_tunnel_alloc_dma(tb, nhi_port, dst_port, transmit_path, -- 2.34.1