From: Eric Biggers <ebiggers@kernel.org>
To: Dan Carpenter <error27@gmail.com>
Cc: linux-crypto@vger.kernel.org
Subject: Re: [bug report] crypto: omap - switch from scatter_walk to plain offset
Date: Tue, 2 Jun 2026 17:26:22 +0000 [thread overview]
Message-ID: <20260602172622.GA2503276@google.com> (raw)
In-Reply-To: <ah6SJiFErFV17cMi@stanley.mountain>
On Tue, Jun 02, 2026 at 11:19:50AM +0300, Dan Carpenter wrote:
> Hello Eric Biggers,
>
> Commit 42c5675c2f5b ("crypto: omap - switch from scatter_walk to
> plain offset") from Jan 5, 2025 (linux-next), leads to the following
> Smatch static checker warning:
>
> drivers/crypto/omap-des.c:842 omap_des_irq() error: we previously assumed 'dd->in_sg' could be null (see line 844)
> drivers/crypto/omap-des.c:872 omap_des_irq() error: we previously assumed 'dd->out_sg' could be null (see line 874)
>
> drivers/crypto/omap-des.c
> 823 static irqreturn_t omap_des_irq(int irq, void *dev_id)
> 824 {
> 825 struct omap_des_dev *dd = dev_id;
> 826 u32 status, i;
> 827 u32 *src, *dst;
> 828
> 829 status = omap_des_read(dd, DES_REG_IRQ_STATUS(dd));
> 830 if (status & DES_REG_IRQ_DATA_IN) {
> 831 omap_des_write(dd, DES_REG_IRQ_ENABLE(dd), 0x0);
> 832
> 833 BUG_ON(!dd->in_sg);
> 834
> 835 BUG_ON(dd->in_sg_offset > dd->in_sg->length);
> 836
> 837 src = sg_virt(dd->in_sg) + dd->in_sg_offset;
> 838
> 839 for (i = 0; i < DES_BLOCK_WORDS; i++) {
> 840 omap_des_write(dd, DES_REG_DATA_N(dd, i), *src);
> 841 dd->in_sg_offset += 4;
> --> 842 if (dd->in_sg_offset == dd->in_sg->length) {
> ^^^^^^^^^
> Dereference.
>
> 843 dd->in_sg = sg_next(dd->in_sg);
>
> Imagine that sg_next() returns NULL, then the next iteration through the
> loop will crash.
>
> 844 if (dd->in_sg) {
> 845 dd->in_sg_offset = 0;
> 846 src = sg_virt(dd->in_sg);
> 847 }
> 848 } else {
> 849 src++;
> 850 }
> 851 }
> 852
> 853 /* Clear IRQ status */
Pre-existing bug.
- Eric
prev parent reply other threads:[~2026-06-02 17:26 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-02 8:19 [bug report] crypto: omap - switch from scatter_walk to plain offset Dan Carpenter
2026-06-02 17:26 ` Eric Biggers [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260602172622.GA2503276@google.com \
--to=ebiggers@kernel.org \
--cc=error27@gmail.com \
--cc=linux-crypto@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox