Messages in this thread | | | Date | Thu, 8 Aug 2019 18:51:40 +0530 | From | Vinod Koul <> | Subject | Re: [PATCH] dma: mv_xor: Fix a possible null-pointer dereference in mv_xor_prep_dma_xor() |
| |
On 27-07-19, 17:30, Jia-Ju Bai wrote: > In mv_xor_prep_dma_xor(), there is an if statement on line 577 to check > whether sw_desc is NULL: > if (sw_desc) > > When sw_desc is NULL, it is used on line 594: > dev_dbg(..., sw_desc, &sw_desc->async_tx); > > Thus, a possible null-pointer dereference may occur. > > To fix this bug, sw_desc is checked before being used. > > This bug is found by a static analysis tool STCheck written by us. > > Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> > --- > drivers/dma/mv_xor.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c > index 0ac8e7b34e12..08c0b2a9eb32 100644 > --- a/drivers/dma/mv_xor.c > +++ b/drivers/dma/mv_xor.c > @@ -589,9 +589,11 @@ mv_xor_prep_dma_xor(struct dma_chan *chan, dma_addr_t dest, dma_addr_t *src, > } > } > > - dev_dbg(mv_chan_to_devp(mv_chan), > - "%s sw_desc %p async_tx %p \n", > - __func__, sw_desc, &sw_desc->async_tx); > + if (sw_desc) { > + dev_dbg(mv_chan_to_devp(mv_chan), > + "%s sw_desc %p async_tx %p \n", > + __func__, sw_desc, &sw_desc->async_tx); > + }
why not move this into the preceeding if condition?
> return sw_desc ? &sw_desc->async_tx : NULL; > } > > -- > 2.17.0
-- ~Vinod
| |