* [bug report] crypto: omap - switch from scatter_walk to plain offset
@ 2026-06-02 8:19 Dan Carpenter
2026-06-02 17:26 ` Eric Biggers
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2026-06-02 8:19 UTC (permalink / raw)
To: Eric Biggers; +Cc: linux-crypto
Hello Eric Biggers,
Commit 42c5675c2f5b ("crypto: omap - switch from scatter_walk to
plain offset") from Jan 5, 2025 (linux-next), leads to the following
Smatch static checker warning:
drivers/crypto/omap-des.c:842 omap_des_irq() error: we previously assumed 'dd->in_sg' could be null (see line 844)
drivers/crypto/omap-des.c:872 omap_des_irq() error: we previously assumed 'dd->out_sg' could be null (see line 874)
drivers/crypto/omap-des.c
823 static irqreturn_t omap_des_irq(int irq, void *dev_id)
824 {
825 struct omap_des_dev *dd = dev_id;
826 u32 status, i;
827 u32 *src, *dst;
828
829 status = omap_des_read(dd, DES_REG_IRQ_STATUS(dd));
830 if (status & DES_REG_IRQ_DATA_IN) {
831 omap_des_write(dd, DES_REG_IRQ_ENABLE(dd), 0x0);
832
833 BUG_ON(!dd->in_sg);
834
835 BUG_ON(dd->in_sg_offset > dd->in_sg->length);
836
837 src = sg_virt(dd->in_sg) + dd->in_sg_offset;
838
839 for (i = 0; i < DES_BLOCK_WORDS; i++) {
840 omap_des_write(dd, DES_REG_DATA_N(dd, i), *src);
841 dd->in_sg_offset += 4;
--> 842 if (dd->in_sg_offset == dd->in_sg->length) {
^^^^^^^^^
Dereference.
843 dd->in_sg = sg_next(dd->in_sg);
Imagine that sg_next() returns NULL, then the next iteration through the
loop will crash.
844 if (dd->in_sg) {
845 dd->in_sg_offset = 0;
846 src = sg_virt(dd->in_sg);
847 }
848 } else {
849 src++;
850 }
851 }
852
853 /* Clear IRQ status */
This email is a free service from the Smatch-CI project [smatch.sf.net].
regards,
dan carpenter
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [bug report] crypto: omap - switch from scatter_walk to plain offset
2026-06-02 8:19 [bug report] crypto: omap - switch from scatter_walk to plain offset Dan Carpenter
@ 2026-06-02 17:26 ` Eric Biggers
0 siblings, 0 replies; 2+ messages in thread
From: Eric Biggers @ 2026-06-02 17:26 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-crypto
On Tue, Jun 02, 2026 at 11:19:50AM +0300, Dan Carpenter wrote:
> Hello Eric Biggers,
>
> Commit 42c5675c2f5b ("crypto: omap - switch from scatter_walk to
> plain offset") from Jan 5, 2025 (linux-next), leads to the following
> Smatch static checker warning:
>
> drivers/crypto/omap-des.c:842 omap_des_irq() error: we previously assumed 'dd->in_sg' could be null (see line 844)
> drivers/crypto/omap-des.c:872 omap_des_irq() error: we previously assumed 'dd->out_sg' could be null (see line 874)
>
> drivers/crypto/omap-des.c
> 823 static irqreturn_t omap_des_irq(int irq, void *dev_id)
> 824 {
> 825 struct omap_des_dev *dd = dev_id;
> 826 u32 status, i;
> 827 u32 *src, *dst;
> 828
> 829 status = omap_des_read(dd, DES_REG_IRQ_STATUS(dd));
> 830 if (status & DES_REG_IRQ_DATA_IN) {
> 831 omap_des_write(dd, DES_REG_IRQ_ENABLE(dd), 0x0);
> 832
> 833 BUG_ON(!dd->in_sg);
> 834
> 835 BUG_ON(dd->in_sg_offset > dd->in_sg->length);
> 836
> 837 src = sg_virt(dd->in_sg) + dd->in_sg_offset;
> 838
> 839 for (i = 0; i < DES_BLOCK_WORDS; i++) {
> 840 omap_des_write(dd, DES_REG_DATA_N(dd, i), *src);
> 841 dd->in_sg_offset += 4;
> --> 842 if (dd->in_sg_offset == dd->in_sg->length) {
> ^^^^^^^^^
> Dereference.
>
> 843 dd->in_sg = sg_next(dd->in_sg);
>
> Imagine that sg_next() returns NULL, then the next iteration through the
> loop will crash.
>
> 844 if (dd->in_sg) {
> 845 dd->in_sg_offset = 0;
> 846 src = sg_virt(dd->in_sg);
> 847 }
> 848 } else {
> 849 src++;
> 850 }
> 851 }
> 852
> 853 /* Clear IRQ status */
Pre-existing bug.
- Eric
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-06-02 17:26 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-02 8:19 [bug report] crypto: omap - switch from scatter_walk to plain offset Dan Carpenter
2026-06-02 17:26 ` Eric Biggers
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox