From 36bdf9fb37f5212e1bbe74629937ce03df73a134 Mon Sep 17 00:00:00 2001 From: hanzj Date: Sat, 30 May 2026 07:29:38 +0800 Subject: [PATCH] drivers/analog/dac7554: Add NULL checks after kmm_malloc in dac7554_initialize dac7554_initialize() calls kmm_malloc twice without checking the return value. If either allocation fails, the subsequent pointer dereferences lead to a NULL pointer access and crash. Add NULL checks for both allocations, following the pattern already used in mcp3008.c, mcp48xx.c, and mcp47x6.c. When the second allocation fails, free the first allocation before returning NULL. Signed-off-by: hanzj --- drivers/analog/dac7554.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/analog/dac7554.c b/drivers/analog/dac7554.c index 9f508968c28..e8e02e5c0d9 100644 --- a/drivers/analog/dac7554.c +++ b/drivers/analog/dac7554.c @@ -248,10 +248,23 @@ FAR struct dac_dev_s *dac7554_initialize(FAR struct spi_dev_s *spi, /* Initialize the DAC7554 device structure */ priv = kmm_malloc(sizeof(struct dac7554_dev_s)); + if (priv == NULL) + { + aerr("ERROR: Failed to allocate dac7554_dev_s instance\n"); + return NULL; + } + priv->spi = spi; priv->spidev = spidev; g_dacdev = kmm_malloc(sizeof(struct dac_dev_s)); + if (g_dacdev == NULL) + { + aerr("ERROR: Failed to allocate dac_dev_s instance\n"); + kmm_free(priv); + return NULL; + } + g_dacdev->ad_ops = &g_dacops; g_dacdev->ad_priv = priv;