Hello Srinivas Kandagatla,
This is a semi-automatic email about new static checker warnings.
The patch 917809e2280b: "slimbus: ngd: Add qcom SLIMBus NGD driver"
from Jun 19, 2018, leads to the following Smatch complaint:
drivers/slimbus/qcom-ngd-ctrl.c:867 qcom_slim_ngd_xfer_msg()
warn: variable dereferenced before check 'txn->msg' (see line 791)
drivers/slimbus/qcom-ngd-ctrl.c
790
791 if (txn->msg->num_bytes > SLIM_MSGQ_BUF_LEN ||
^^^^^^^^^
Dereference
792 txn->rl > SLIM_MSGQ_BUF_LEN) {
793 dev_err(ctrl->dev, "msg exeeds HW limit\n");
794 return -EINVAL;
795 }
796
797 pbuf = qcom_slim_ngd_tx_msg_get(ctrl, txn->rl, &tx_sent);
798 if (!pbuf) {
799 dev_err(ctrl->dev, "Message buffer unavailable\n");
800 return -ENOMEM;
801 }
802
803 if (txn->mt == SLIM_MSG_MT_CORE &&
804 (txn->mc == SLIM_MSG_MC_CONNECT_SOURCE ||
805 txn->mc == SLIM_MSG_MC_CONNECT_SINK ||
806 txn->mc == SLIM_MSG_MC_DISCONNECT_PORT)) {
807 txn->mt = SLIM_MSG_MT_DEST_REFERRED_USER;
808 switch (txn->mc) {
809 case SLIM_MSG_MC_CONNECT_SOURCE:
810 txn->mc = SLIM_USR_MC_CONNECT_SRC;
811 break;
812 case SLIM_MSG_MC_CONNECT_SINK:
813 txn->mc = SLIM_USR_MC_CONNECT_SINK;
814 break;
815 case SLIM_MSG_MC_DISCONNECT_PORT:
816 txn->mc = SLIM_USR_MC_DISCONNECT_PORT;
817 break;
818 default:
819 return -EINVAL;
820 }
821
822 usr_msg = true;
823 i = 0;
824 wbuf[i++] = txn->la;
825 la = SLIM_LA_MGR;
826 wbuf[i++] = txn->msg->wbuf[0];
827 if (txn->mc != SLIM_USR_MC_DISCONNECT_PORT)
828 wbuf[i++] = txn->msg->wbuf[1];
829
830 txn->comp = &done;
831 ret = slim_alloc_txn_tid(sctrl, txn);
832 if (ret) {
833 dev_err(ctrl->dev, "Unable to allocate TID\n");
834 return ret;
835 }
836
837 wbuf[i++] = txn->tid;
838
839 txn->msg->num_bytes = i;
840 txn->msg->wbuf = wbuf;
841 txn->msg->rbuf = rbuf;
842 txn->rl = txn->msg->num_bytes + 4;
843 }
844
845 /* HW expects length field to be excluded */
846 txn->rl--;
847 puc = (u8 *)pbuf;
848 *pbuf = 0;
849 if (txn->dt == SLIM_MSG_DEST_LOGICALADDR) {
850 *pbuf = SLIM_MSG_ASM_FIRST_WORD(txn->rl, txn->mt, txn->mc, 0,
851 la);
852 puc += 3;
853 } else {
854 *pbuf = SLIM_MSG_ASM_FIRST_WORD(txn->rl, txn->mt, txn->mc, 1,
855 la);
856 puc += 2;
857 }
858
859 if (slim_tid_txn(txn->mt, txn->mc))
860 *(puc++) = txn->tid;
861
862 if (slim_ec_txn(txn->mt, txn->mc)) {
863 *(puc++) = (txn->ec & 0xFF);
864 *(puc++) = (txn->ec >> 8) & 0xFF;
865 }
866
867 if (txn->msg && txn->msg->wbuf)
^^^^^^^^
This check is too late.
868 memcpy(puc, txn->msg->wbuf, txn->msg->num_bytes);
869
regards,
dan carpenter
_______________________________________________
Alsa-devel mailing list
Alsa-devel@xxxxxxxxxxxxxxxx
http://mailman.alsa-project.org/mailman/listinfo/alsa-devel
