Messages in this thread | | | Date | Fri, 03 Apr 2020 15:05:49 +0200 | From | Michael Walle <> | Subject | Re: tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug report |
| |
Am 2020-04-03 14:44, schrieb Colin Ian King: > Hi, > > Static analysis with Coverity has found an issue with the following > commit: > > From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001 > From: Michael Walle <michael@walle.cc> > Date: Fri, 6 Mar 2020 22:44:31 +0100 > Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping > > The analysis report is as follows for function lpuart_dma_rx_free in > source drivers/tty/serial/fsl_lpuart.c : > > var_compare_op: Comparing chan to null implies that chan might be null. > > 1234 if (chan) > 1235 dmaengine_terminate_all(chan); > 1236 > > Dereference after null check (FORWARD_NULL) > var_deref_op: Dereferencing null pointer chan. > > 1237 dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1, > DMA_FROM_DEVICE); > > The check for chan being null implies it is may be null, however, the > call to dma_unmap_sg dereferences chan which leads to a null pointer > dereference issue.
Technically, this is correct. But lpuart_dma_rx_free() is guarded by lpuart_dma_rx_use which is only true if there is a dma channel, see lpuart_rx_dma_startup(). In any way, this looks bogus.
So actually, the "if (chan)" is superfluous. Could you double check that? Then I'd make a patch which removes the if (chan) to make coverity happy.
-michael
| |