* re: tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug report
@ 2020-04-03 12:44 Colin Ian King
2020-04-03 13:05 ` Michael Walle
0 siblings, 1 reply; 3+ messages in thread
From: Colin Ian King @ 2020-04-03 12:44 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby, linux-serial, Michael Walle; +Cc: linux-kernel
Hi,
Static analysis with Coverity has found an issue with the following commit:
From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001
From: Michael Walle <michael@walle.cc>
Date: Fri, 6 Mar 2020 22:44:31 +0100
Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping
The analysis report is as follows for function lpuart_dma_rx_free in
source drivers/tty/serial/fsl_lpuart.c :
var_compare_op: Comparing chan to null implies that chan might be null.
1234 if (chan)
1235 dmaengine_terminate_all(chan);
1236
Dereference after null check (FORWARD_NULL)
var_deref_op: Dereferencing null pointer chan.
1237 dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1,
DMA_FROM_DEVICE);
The check for chan being null implies it is may be null, however, the
call to dma_unmap_sg dereferences chan which leads to a null pointer
dereference issue.
Colin
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug report
2020-04-03 12:44 tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug report Colin Ian King
@ 2020-04-03 13:05 ` Michael Walle
2020-04-03 13:13 ` Colin Ian King
0 siblings, 1 reply; 3+ messages in thread
From: Michael Walle @ 2020-04-03 13:05 UTC (permalink / raw)
To: Colin Ian King; +Cc: Greg Kroah-Hartman, Jiri Slaby, linux-serial, linux-kernel
Am 2020-04-03 14:44, schrieb Colin Ian King:
> Hi,
>
> Static analysis with Coverity has found an issue with the following
> commit:
>
> From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001
> From: Michael Walle <michael@walle.cc>
> Date: Fri, 6 Mar 2020 22:44:31 +0100
> Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping
>
> The analysis report is as follows for function lpuart_dma_rx_free in
> source drivers/tty/serial/fsl_lpuart.c :
>
> var_compare_op: Comparing chan to null implies that chan might be null.
>
> 1234 if (chan)
> 1235 dmaengine_terminate_all(chan);
> 1236
>
> Dereference after null check (FORWARD_NULL)
> var_deref_op: Dereferencing null pointer chan.
>
> 1237 dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1,
> DMA_FROM_DEVICE);
>
> The check for chan being null implies it is may be null, however, the
> call to dma_unmap_sg dereferences chan which leads to a null pointer
> dereference issue.
Technically, this is correct. But lpuart_dma_rx_free() is guarded by
lpuart_dma_rx_use which is only true if there is a dma channel, see
lpuart_rx_dma_startup(). In any way, this looks bogus.
So actually, the "if (chan)" is superfluous. Could you double check
that?
Then I'd make a patch which removes the if (chan) to make coverity
happy.
-michael
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug report
2020-04-03 13:05 ` Michael Walle
@ 2020-04-03 13:13 ` Colin Ian King
0 siblings, 0 replies; 3+ messages in thread
From: Colin Ian King @ 2020-04-03 13:13 UTC (permalink / raw)
To: Michael Walle; +Cc: Greg Kroah-Hartman, Jiri Slaby, linux-serial, linux-kernel
On 03/04/2020 14:05, Michael Walle wrote:
> Am 2020-04-03 14:44, schrieb Colin Ian King:
>> Hi,
>>
>> Static analysis with Coverity has found an issue with the following
>> commit:
>>
>> From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001
>> From: Michael Walle <michael@walle.cc>
>> Date: Fri, 6 Mar 2020 22:44:31 +0100
>> Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping
>>
>> The analysis report is as follows for function lpuart_dma_rx_free in
>> source drivers/tty/serial/fsl_lpuart.c :
>>
>> var_compare_op: Comparing chan to null implies that chan might be null.
>>
>> 1234 if (chan)
>> 1235 dmaengine_terminate_all(chan);
>> 1236
>>
>> Dereference after null check (FORWARD_NULL)
>> var_deref_op: Dereferencing null pointer chan.
>>
>> 1237 dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1,
>> DMA_FROM_DEVICE);
>>
>> The check for chan being null implies it is may be null, however, the
>> call to dma_unmap_sg dereferences chan which leads to a null pointer
>> dereference issue.
>
> Technically, this is correct. But lpuart_dma_rx_free() is guarded by
> lpuart_dma_rx_use which is only true if there is a dma channel, see
> lpuart_rx_dma_startup(). In any way, this looks bogus.
>
> So actually, the "if (chan)" is superfluous. Could you double check that?
> Then I'd make a patch which removes the if (chan) to make coverity happy.
Yep, I've eyeballed the code and all the calls to the
lpuart_dma_rx_free() check lpuart_dma_rx_use is true before the call, so
it does appear the if (chan) check is superfluous.
Colin
>
> -michael
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-04-03 13:13 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-03 12:44 tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug report Colin Ian King
2020-04-03 13:05 ` Michael Walle
2020-04-03 13:13 ` Colin Ian King
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).