Re: [PATCH] spi: stm32: fix NULL check on pointer-to-pointer variable

[Clement LE GOFFIC <clement.legoffic@foss.st.com>]

Hi Antonio,

On 6/28/25 02:02, Antonio Quartulli wrote:
> In stm32_spi_prepare_rx_dma_mdma_chaining() both rx_dma_desc
> and rx_mdma_desc are passed as pointer-to-pointer arguments.
> 
> The goal is to pass back to the caller the value returned
> by dmaengine_prep_slave_sg(), when it is not NULL.
> 
> However, the NULL check on the result is erroneously
> performed without dereferencing the pointer.
> 
> Add the proper dereference operator to both checks.
> 
> Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use")
> Addresses-Coverity-ID: 1644715 ("Null pointer dereferences (REVERSE_INULL)")
> Signed-off-by: Antonio Quartulli <antonio@mandelbit.com>
> ---
>   drivers/spi/spi-stm32.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c
> index 3d20f09f1ae7..e9fa17e52fb0 100644
> --- a/drivers/spi/spi-stm32.c
> +++ b/drivers/spi/spi-stm32.c
> @@ -1529,7 +1529,7 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
>   					       DMA_PREP_INTERRUPT);
>   	sg_free_table(&dma_sgt);
>   
> -	if (!rx_dma_desc)
> +	if (!*rx_dma_desc)
>   		return -EINVAL;
>   
>   	/* Prepare MDMA slave_sg transfer MEM_TO_MEM (SRAM>DDR) */
> @@ -1563,8 +1563,8 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi,
>   						DMA_PREP_INTERRUPT);
>   	sg_free_table(&mdma_sgt);
>   
> -	if (!rx_mdma_desc) {
> -		rx_dma_desc = NULL;
> +	if (!*rx_mdma_desc) {
> +		*rx_dma_desc = NULL;
>   		return -EINVAL;
>   	}
>   

Good catch for both pointers !

For readability, I would suggest to define two dma_async_tx_descriptor 
ptr at the beginning of the function such as :
	struct dma_async_tx_descriptor *_mdma_desc = *rx_mdma_desc;
	struct dma_async_tx_descriptor *_dma_desc = *rx_dma_desc;

And then use them all along the function even in the assignation.

Best regards,
Clément