Hello Bean Huo,
The patch 6ff265fc5ef6: "scsi: ufs: core: bsg: Add advanced RPMB
support in ufs_bsg" from Dec 1, 2022, leads to the following Smatch
static checker warning:
drivers/ufs/core/ufs_bsg.c:121 ufs_bsg_exec_advanced_rpmb_req()
error: uninitialized symbol 'sg_cnt'.
drivers/ufs/core/ufs_bsg.c
67 static int ufs_bsg_exec_advanced_rpmb_req(struct ufs_hba *hba, struct bsg_job *job)
68 {
69 struct ufs_rpmb_request *rpmb_request = job->request;
70 struct ufs_rpmb_reply *rpmb_reply = job->reply;
71 struct bsg_buffer *payload = NULL;
72 enum dma_data_direction dir;
73 struct scatterlist *sg_list;
74 int rpmb_req_type;
75 int sg_cnt;
76 int ret;
77 int data_len;
78
79 if (hba->ufs_version < ufshci_version(4, 0) || !hba->dev_info.b_advanced_rpmb_en ||
80 !(hba->capabilities & MASK_EHSLUTRD_SUPPORTED))
81 return -EINVAL;
82
83 if (rpmb_request->ehs_req.length != 2 || rpmb_request->ehs_req.ehs_type != 1)
84 return -EINVAL;
85
86 rpmb_req_type = be16_to_cpu(rpmb_request->ehs_req.meta.req_resp_type);
87
88 switch (rpmb_req_type) {
89 case UFS_RPMB_WRITE_KEY:
90 case UFS_RPMB_READ_CNT:
91 case UFS_RPMB_PURGE_ENABLE:
92 dir = DMA_NONE;
93 break;
94 case UFS_RPMB_WRITE:
95 case UFS_RPMB_SEC_CONF_WRITE:
96 dir = DMA_TO_DEVICE;
97 break;
98 case UFS_RPMB_READ:
99 case UFS_RPMB_SEC_CONF_READ:
100 case UFS_RPMB_PURGE_STATUS_READ:
101 dir = DMA_FROM_DEVICE;
102 break;
103 default:
104 return -EINVAL;
105 }
106
107 if (dir != DMA_NONE) {
108 payload = &job->request_payload;
109 if (!payload || !payload->payload_len || !payload->sg_cnt)
110 return -EINVAL;
111
112 sg_cnt = dma_map_sg(hba->host->dma_dev, payload->sg_list, payload->sg_cnt, dir);
113 if (unlikely(!sg_cnt))
114 return -ENOMEM;
115 sg_list = payload->sg_list;
116 data_len = payload->payload_len;
117 }
"sg_cnt" not initialized on else path.
118
119 ret = ufshcd_advanced_rpmb_req_handler(hba, &rpmb_request->bsg_request.upiu_req,
120 &rpmb_reply->bsg_reply.upiu_rsp, &rpmb_request->ehs_req,
--> 121 &rpmb_reply->ehs_rsp, sg_cnt, sg_list, dir);
^^^^^^
122
123 if (dir != DMA_NONE) {
124 dma_unmap_sg(hba->host->dma_dev, payload->sg_list, payload->sg_cnt, dir);
125
126 if (!ret)
127 rpmb_reply->bsg_reply.reply_payload_rcv_len = data_len;
128 }
129
130 return ret;
131 }
regards,
dan carpenter
