[bug report] dmaengine: stm32-dma: Fix residue computation issue in cyclic mode

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello M'boumba Cedric Madianga,

The patch 2b12c5580e0a: "dmaengine: stm32-dma: Fix residue
computation issue in cyclic mode" from Dec 13, 2016, leads to the
following static checker warning:

	drivers/dma/stm32-dma.c:914 stm32_dma_tx_status()
	error: we previously assumed 'chan->desc' could be null (see line 910)

drivers/dma/stm32-dma.c
   868  static size_t stm32_dma_desc_residue(struct stm32_dma_chan *chan,
   869                                       struct stm32_dma_desc *desc,
   870                                       u32 next_sg)
   871  {
   872          u32 residue = 0;
   873          int i;
   874  
   875          /*
   876           * In cyclic mode, for the last period, residue = remaining bytes from
   877           * NDTR
   878           */
   879          if (chan->desc->cyclic && next_sg == 0)

Should this just be "desc->cyclic"?

   880                  return stm32_dma_get_remaining_bytes(chan);
   881  
   882          /*
   883           * For all other periods in cyclic mode, and in sg mode,
   884           * residue = remaining bytes from NDTR + remaining periods/sg to be
   885           * transferred
   886           */
   887          for (i = next_sg; i < desc->num_sgs; i++)
   888                  residue += desc->sg_req[i].len;
   889          residue += stm32_dma_get_remaining_bytes(chan);
   890  
   891          return residue;
   892  }

[ snip ] 

   894  static enum dma_status stm32_dma_tx_status(struct dma_chan *c,
   895                                             dma_cookie_t cookie,
   896                                             struct dma_tx_state *state)
   897  {
   898          struct stm32_dma_chan *chan = to_stm32_dma_chan(c);
   899          struct virt_dma_desc *vdesc;
   900          enum dma_status status;
   901          unsigned long flags;
   902          u32 residue = 0;
   903  
   904          status = dma_cookie_status(c, cookie, state);
   905          if ((status == DMA_COMPLETE) || (!state))
   906                  return status;
   907  
   908          spin_lock_irqsave(&chan->vchan.lock, flags);
   909          vdesc = vchan_find_desc(&chan->vchan, cookie);
   910          if (chan->desc && cookie == chan->desc->vdesc.tx.cookie)
                    ^^^^^^^^^^
Check for NULL

   911                  residue = stm32_dma_desc_residue(chan, chan->desc,
   912                                                   chan->next_sg);
   913          else if (vdesc)
   914                  residue = stm32_dma_desc_residue(chan,
                                                         ^^^^
Unchecked dereference.

   915                                                   to_stm32_dma_desc(vdesc), 0);
   916          dma_set_residue(state, residue);
   917  
   918          spin_unlock_irqrestore(&chan->vchan.lock, flags);
   919  
   920          return status;
   921  }
   922  

regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe dmaengine" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Kernel]     [Linux ARM (vger)]     [Linux ARM MSM]     [Linux Omap]     [Linux Arm]     [Linux Tegra]     [Fedora ARM]     [Linux for Samsung SOC]     [eCos]     [Linux PCI]     [Linux Fastboot]     [Gcc Help]     [Git]     [DCCP]     [IETF Announce]     [Security]     [Linux MIPS]     [Yosemite Campsites]

  Powered by Linux