archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-09 04:16:35 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

spi: stm32: fix pointer-to-pointer variables usage

Browse source 
In stm32_spi_prepare_rx_dma_mdma_chaining() both rx_dma_desc
and rx_mdma_desc are passed as pointer-to-pointer arguments.

The goal is to pass back to the caller the value returned
by dmaengine_prep_slave_sg(), when it is not NULL.

However, these variables are wrongly handled as simple pointers
during later assignments and checks.

Fix this behaviour by introducing two pointer variables
which can then be treated accordingly.

Fixes: d17dd2f1d8 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use")
Addresses-Coverity-ID: 1644715 ("Null pointer dereferences (REVERSE_INULL)")
Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
Reviewed-by: Clement LE GOFFIC <clement.legoffic@foss.st.com>
Link: https://patch.msgid.link/20250630081253.17294-1-antonio@mandelbit.com
Signed-off-by: Mark Brown <broonie@kernel.org>
This commit is contained in:
Antonio Quartulli 2025-06-30 10:12:53 +02:00 • committed by Mark Brown
parent f4d8438e6a
commit c4f2c05ab0
No known key found for this signature in database
GPG key ID: 24D68B725D5487D0
1 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

22
drivers/spi/spi-stm32.c
View file

@ -1474,6 +1474,8 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
struct dma_async_tx_descriptor **rx_dma_desc,
struct dma_async_tx_descriptor **rx_mdma_desc)
{
struct dma_async_tx_descriptor *_mdma_desc = *rx_mdma_desc;
struct dma_async_tx_descriptor *_dma_desc = *rx_dma_desc;
struct dma_slave_config rx_mdma_conf = {0};
u32 sram_period, nents = 0, spi_s_len;
struct sg_table dma_sgt, mdma_sgt;
@ -1524,18 +1526,18 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
}
}
*rx_dma_desc = dmaengine_prep_slave_sg(spi->dma_rx, dma_sgt.sgl,
dma_sgt.nents, rx_dma_conf->direction,
DMA_PREP_INTERRUPT);
_dma_desc = dmaengine_prep_slave_sg(spi->dma_rx, dma_sgt.sgl,
dma_sgt.nents, rx_dma_conf->direction,
DMA_PREP_INTERRUPT);
sg_free_table(&dma_sgt);
if (!rx_dma_desc)
if (!_dma_desc)
return -EINVAL;
/* Prepare MDMA slave_sg transfer MEM_TO_MEM (SRAM>DDR) */
ret = sg_alloc_table(&mdma_sgt, nents, GFP_ATOMIC);
if (ret) {
rx_dma_desc = NULL;
_dma_desc = NULL;
return ret;
}
@ -1558,13 +1560,13 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
}
}
*rx_mdma_desc = dmaengine_prep_slave_sg(spi->mdma_rx, mdma_sgt.sgl,
mdma_sgt.nents, rx_mdma_conf.direction,
DMA_PREP_INTERRUPT);
_mdma_desc = dmaengine_prep_slave_sg(spi->mdma_rx, mdma_sgt.sgl,
mdma_sgt.nents, rx_mdma_conf.direction,
DMA_PREP_INTERRUPT);
sg_free_table(&mdma_sgt);
if (!rx_mdma_desc) {
rx_dma_desc = NULL;
if (!_mdma_desc) {
_dma_desc = NULL;
return -EINVAL;
}