[PATCH v2] spi: stm32: fix pointer-to-pointer variables usage
Clement LE GOFFIC
clement.legoffic at foss.st.com
Mon Jun 30 01:28:50 PDT 2025
On 6/30/25 10:12, Antonio Quartulli wrote:
> In stm32_spi_prepare_rx_dma_mdma_chaining() both rx_dma_desc
> and rx_mdma_desc are passed as pointer-to-pointer arguments.
>
> The goal is to pass back to the caller the value returned
> by dmaengine_prep_slave_sg(), when it is not NULL.
>
> However, these variables are wrongly handled as simple pointers
> during later assignments and checks.
>
> Fix this behaviour by introducing two pointer variables
> which can then be treated accordingly.
>
> Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use")
> Addresses-Coverity-ID: 1644715 ("Null pointer dereferences (REVERSE_INULL)")
> Signed-off-by: Antonio Quartulli <antonio at mandelbit.com>
>
> ---
> Changes from v1:
> * introduce *_mdma_desc and *_dma_desc for better readability
> * fix another instance of rx_dma_desc bogus assignment in case of
> failure of sg_alloc_table()
> * commit title/message reworded accordingly to the previous point
> ---
> drivers/spi/spi-stm32.c | 22 ++++++++++++----------
> 1 file changed, 12 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
> index 3d20f09f1ae7..4b7f074fdba9 100644
> --- a/drivers/spi/spi-stm32.c
> +++ b/drivers/spi/spi-stm32.c
> @@ -1474,6 +1474,8 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
> struct dma_async_tx_descriptor **rx_dma_desc,
> struct dma_async_tx_descriptor **rx_mdma_desc)
> {
> + struct dma_async_tx_descriptor *_mdma_desc = *rx_mdma_desc;
> + struct dma_async_tx_descriptor *_dma_desc = *rx_dma_desc;
> struct dma_slave_config rx_mdma_conf = {0};
> u32 sram_period, nents = 0, spi_s_len;
> struct sg_table dma_sgt, mdma_sgt;
> @@ -1524,18 +1526,18 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
> }
> }
>
> - *rx_dma_desc = dmaengine_prep_slave_sg(spi->dma_rx, dma_sgt.sgl,
> - dma_sgt.nents, rx_dma_conf->direction,
> - DMA_PREP_INTERRUPT);
> + _dma_desc = dmaengine_prep_slave_sg(spi->dma_rx, dma_sgt.sgl,
> + dma_sgt.nents, rx_dma_conf->direction,
> + DMA_PREP_INTERRUPT);
> sg_free_table(&dma_sgt);
>
> - if (!rx_dma_desc)
> + if (!_dma_desc)
> return -EINVAL;
>
> /* Prepare MDMA slave_sg transfer MEM_TO_MEM (SRAM>DDR) */
> ret = sg_alloc_table(&mdma_sgt, nents, GFP_ATOMIC);
> if (ret) {
> - rx_dma_desc = NULL;
> + _dma_desc = NULL;
> return ret;
> }
>
> @@ -1558,13 +1560,13 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
> }
> }
>
> - *rx_mdma_desc = dmaengine_prep_slave_sg(spi->mdma_rx, mdma_sgt.sgl,
> - mdma_sgt.nents, rx_mdma_conf.direction,
> - DMA_PREP_INTERRUPT);
> + _mdma_desc = dmaengine_prep_slave_sg(spi->mdma_rx, mdma_sgt.sgl,
> + mdma_sgt.nents, rx_mdma_conf.direction,
> + DMA_PREP_INTERRUPT);
> sg_free_table(&mdma_sgt);
>
> - if (!rx_mdma_desc) {
> - rx_dma_desc = NULL;
> + if (!_mdma_desc) {
> + _dma_desc = NULL;
> return -EINVAL;
> }
>
Thank you, LGTM
You can add my Reviewed-by
Best regards,
Clément
More information about the linux-arm-kernel
mailing list