lkml.org 
[lkml]   [2020]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug report
Am 2020-04-03 14:44, schrieb Colin Ian King:
> Hi,
>
> Static analysis with Coverity has found an issue with the following
> commit:
>
> From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001
> From: Michael Walle <michael@walle.cc>
> Date: Fri, 6 Mar 2020 22:44:31 +0100
> Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping
>
> The analysis report is as follows for function lpuart_dma_rx_free in
> source drivers/tty/serial/fsl_lpuart.c :
>
> var_compare_op: Comparing chan to null implies that chan might be null.
>
> 1234 if (chan)
> 1235 dmaengine_terminate_all(chan);
> 1236
>
> Dereference after null check (FORWARD_NULL)
> var_deref_op: Dereferencing null pointer chan.
>
> 1237 dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1,
> DMA_FROM_DEVICE);
>
> The check for chan being null implies it is may be null, however, the
> call to dma_unmap_sg dereferences chan which leads to a null pointer
> dereference issue.

Technically, this is correct. But lpuart_dma_rx_free() is guarded by
lpuart_dma_rx_use which is only true if there is a dma channel, see
lpuart_rx_dma_startup(). In any way, this looks bogus.

So actually, the "if (chan)" is superfluous. Could you double check
that?
Then I'd make a patch which removes the if (chan) to make coverity
happy.

-michael

\
 
 \ /
  Last update: 2020-04-03 15:06    [W:0.046 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site