In mv_xor_prep_dma_xor(), there is an if statement on line 577 to check whether sw_desc is NULL: if (sw_desc) When sw_desc is NULL, it is used on line 594: dev_dbg(..., sw_desc, &sw_desc->async_tx); Thus, a possible null-pointer dereference may occur. To fix this bug, sw_desc is checked before being used. This bug is found by a static analysis tool STCheck written by us. Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx> --- drivers/dma/mv_xor.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c index 0ac8e7b34e12..08c0b2a9eb32 100644 --- a/drivers/dma/mv_xor.c +++ b/drivers/dma/mv_xor.c @@ -589,9 +589,11 @@ mv_xor_prep_dma_xor(struct dma_chan *chan, dma_addr_t dest, dma_addr_t *src, } } - dev_dbg(mv_chan_to_devp(mv_chan), - "%s sw_desc %p async_tx %p \n", - __func__, sw_desc, &sw_desc->async_tx); + if (sw_desc) { + dev_dbg(mv_chan_to_devp(mv_chan), + "%s sw_desc %p async_tx %p \n", + __func__, sw_desc, &sw_desc->async_tx); + } return sw_desc ? &sw_desc->async_tx : NULL; } -- 2.17.0