Skip to content

Commit 7d5902d

Browse files
moonlight83340danieldegrasse
authored andcommitted
drivers: akm09918c: fix null dereference in submit function
Fix a null pointer dereference in akm09918c_submit(), where writeByte_sqe was dereferenced before checking if it was NULL. Coverity reported this as CID 516247: the pointer returned by i2c_rtio_copy_reg_write_byte() may be NULL, and accessing its `flags` field before checking leads to undefined behavior. Move the access to writeByte_sqe->flags after confirming both writeByte_sqe and cb_sqe are valid. Fixes: CID 516247 Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
1 parent 9eaed80 commit 7d5902d

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

drivers/sensor/asahi_kasei/akm09918c/akm09918c_async.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,10 @@ void akm09918c_submit(const struct device *dev, struct rtio_iodev_sqe *iodev_sqe
6060
data->rtio_ctx, data->iodev, AKM09918C_REG_CNTL2, AKM09918C_CNTL2_SINGLE_MEASURE);
6161
struct rtio_sqe *cb_sqe = rtio_sqe_acquire(data->rtio_ctx);
6262

63-
writeByte_sqe->flags |= RTIO_SQE_CHAINED;
64-
rtio_sqe_prep_callback_no_cqe(cb_sqe, akm09918_after_start_cb, (void *)iodev_sqe, NULL);
65-
6663
if (writeByte_sqe != NULL && cb_sqe != NULL) {
64+
writeByte_sqe->flags |= RTIO_SQE_CHAINED;
65+
rtio_sqe_prep_callback_no_cqe(cb_sqe, akm09918_after_start_cb, (void *)iodev_sqe,
66+
NULL);
6767
rtio_submit(data->rtio_ctx, 0);
6868
} else {
6969
rtio_sqe_drop_all(data->rtio_ctx);

0 commit comments

Comments
 (0)