wifi: brcmfmac: Fix error pointer dereference

The function brcmf_chip_add_core() can return an error pointer and is
not checked. Add checks for error pointer.

Detected by Smatch:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1010 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1013 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1016 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1019 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c:1022 brcmf_chip_recognition() error:
'core' dereferencing possible ERR_PTR()

Fixes: cb7cf7be9eba7 ("brcmfmac: make chip related functions host interface independent")
Signed-off-by: Ethan Tidmore <ethantidmore06@gmail.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20260217023043.73631-1-ethantidmore06@gmail.com
[add missing wifi: prefix]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
index a790f1693b82eb14df84f1a71f9527addc597d0c..4adc0d0e4251bb6ac0f2d95b043e0df0038a4820 100644 (file)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/chip.c
@@ -1007,18 +1007,33 @@ static int brcmf_chip_recognition(struct brcmf_chip_priv *ci)
 
                core = brcmf_chip_add_core(ci, BCMA_CORE_CHIPCOMMON,
                                           SI_ENUM_BASE_DEFAULT, 0);
+               if (IS_ERR(core))
+                       return PTR_ERR(core);
+
                brcmf_chip_sb_corerev(ci, core);
                core = brcmf_chip_add_core(ci, BCMA_CORE_SDIO_DEV,
                                           BCM4329_CORE_BUS_BASE, 0);
+               if (IS_ERR(core))
+                       return PTR_ERR(core);
+
                brcmf_chip_sb_corerev(ci, core);
                core = brcmf_chip_add_core(ci, BCMA_CORE_INTERNAL_MEM,
                                           BCM4329_CORE_SOCRAM_BASE, 0);
+               if (IS_ERR(core))
+                       return PTR_ERR(core);
+
                brcmf_chip_sb_corerev(ci, core);
                core = brcmf_chip_add_core(ci, BCMA_CORE_ARM_CM3,
                                           BCM4329_CORE_ARM_BASE, 0);
+               if (IS_ERR(core))
+                       return PTR_ERR(core);
+
                brcmf_chip_sb_corerev(ci, core);
 
                core = brcmf_chip_add_core(ci, BCMA_CORE_80211, 0x18001000, 0);
+               if (IS_ERR(core))
+                       return PTR_ERR(core);
+
                brcmf_chip_sb_corerev(ci, core);
        } else if (socitype == SOCI_AI) {
                ci->iscoreup = brcmf_chip_ai_iscoreup;