Skip to content

drivers/analog/dac7554: Add NULL checks after kmm_malloc in dac7554_initialize#18996

Merged
lupyuen merged 1 commit into
apache:masterfrom
Zepp-Hanzj:fix/dac7554-null-check
May 30, 2026
Merged

drivers/analog/dac7554: Add NULL checks after kmm_malloc in dac7554_initialize#18996
lupyuen merged 1 commit into
apache:masterfrom
Zepp-Hanzj:fix/dac7554-null-check

Conversation

@Zepp-Hanzj
Copy link
Copy Markdown
Contributor

Description

Add missing NULL checks after both kmm_malloc calls in dac7554_initialize() to prevent NULL pointer dereference on allocation failure.

Problem

dac7554_initialize() calls kmm_malloc twice — first for priv (a dac7554_dev_s), then for g_dacdev (a dac_dev_s) — without checking either return value. If either allocation fails, the code immediately dereferences the NULL pointer, causing a crash.

The function's doc comment states "a NULL on failure", but the implementation never returns NULL.

Solution

Add NULL checks for both allocations, following the same pattern already established in mcp3008.c, mcp48xx.c, and mcp47x6.c:

  1. After the first kmm_malloc for priv: return NULL if it fails.
  2. After the second kmm_malloc for g_dacdev: free priv and return NULL if it fails.

Changes

File: drivers/analog/dac7554.c (+13 lines)

Location (~line 250):

  priv = kmm_malloc(sizeof(struct dac7554_dev_s));
+ if (priv == NULL)
+   {
+     aerr("ERROR: Failed to allocate dac7554_dev_s instance\n");
+     return NULL;
+   }
+
  priv->spi = spi;

  g_dacdev = kmm_malloc(sizeof(struct dac_dev_s));
+ if (g_dacdev == NULL)
+   {
+     aerr("ERROR: Failed to allocate dac_dev_s instance\n");
+     kmm_free(priv);
+     return NULL;
+   }
+
  g_dacdev->ad_ops = &g_dacops;

Verification

Checkpatch: ./tools/checkpatch.sh -g HEAD — All checks pass
Code Review: Pattern matches the existing fixes in mcp3008_initialize() (commit dd5670ed), mcp48xx_initialize() and mcp47x6_initialize() (commit fa1589a6).

Scenario Before After
priv alloc fails NULL deref → crash Returns NULL safely
g_dacdev alloc fails NULL deref → crash Frees priv, returns NULL

Signed-off-by

hanzj hanzjian@zepp.com

…nitialize

dac7554_initialize() calls kmm_malloc twice without checking the return
value.  If either allocation fails, the subsequent pointer dereferences
lead to a NULL pointer access and crash.

Add NULL checks for both allocations, following the pattern already used
in mcp3008.c, mcp48xx.c, and mcp47x6.c.  When the second allocation
fails, free the first allocation before returning NULL.

Signed-off-by: hanzj <hanzjian@zepp.com>
@github-actions github-actions Bot added the Size: S The size of the change in this PR is small label May 29, 2026
@lupyuen lupyuen merged commit 36bdf9f into apache:master May 30, 2026
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Size: S The size of the change in this PR is small

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants