On 03/04/2020 14:05, Michael Walle wrote: > Am 2020-04-03 14:44, schrieb Colin Ian King: >> Hi, >> >> Static analysis with Coverity has found an issue with the following >> commit: >> >> From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001 >> From: Michael Walle <michael@xxxxxxxx> >> Date: Fri, 6 Mar 2020 22:44:31 +0100 >> Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping >> >> The analysis report is as follows for function lpuart_dma_rx_free in >> source drivers/tty/serial/fsl_lpuart.c : >> >> var_compare_op: Comparing chan to null implies that chan might be null. >> >> 1234 if (chan) >> 1235 dmaengine_terminate_all(chan); >> 1236 >> >> Dereference after null check (FORWARD_NULL) >> var_deref_op: Dereferencing null pointer chan. >> >> 1237 dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1, >> DMA_FROM_DEVICE); >> >> The check for chan being null implies it is may be null, however, the >> call to dma_unmap_sg dereferences chan which leads to a null pointer >> dereference issue. > > Technically, this is correct. But lpuart_dma_rx_free() is guarded by > lpuart_dma_rx_use which is only true if there is a dma channel, see > lpuart_rx_dma_startup(). In any way, this looks bogus. > > So actually, the "if (chan)" is superfluous. Could you double check that? > Then I'd make a patch which removes the if (chan) to make coverity happy. Yep, I've eyeballed the code and all the calls to the lpuart_dma_rx_free() check lpuart_dma_rx_use is true before the call, so it does appear the if (chan) check is superfluous. Colin > > -michael
