Re: [bug report] media: rc: ttusbir: respect DMA coherency rules

[Sean Young <sean@mess.org>]

On Fri, Apr 10, 2026 at 01:12:29PM +0300, Dan Carpenter wrote:
> Hello Oliver Neukum,
> 
> Commit 50acaad3d202 ("media: rc: ttusbir: respect DMA coherency
> rules") from Feb 11, 2026 (linux-next), leads to the following Smatch
> static checker warning:
> 
> 	drivers/media/rc/ttusbir.c:281 ttusbir_probe()
> 	error: we previously assumed 'tt->bulk_buffer' could be null (see line 198)
> 
> drivers/media/rc/ttusbir.c
>     180 static int ttusbir_probe(struct usb_interface *intf,
>     181                          const struct usb_device_id *id)
>     182 {
>     183         struct ttusbir *tt;
>     184         struct usb_interface_descriptor *idesc;
>     185         struct usb_endpoint_descriptor *desc;
>     186         struct rc_dev *rc;
>     187         int i, j, ret;
>     188         int altsetting = -1;
>     189         u8 *buffer;
>     190 
>     191         tt = kzalloc_obj(*tt);
>     192         buffer = kzalloc(5, GFP_KERNEL);
>     193         rc = rc_allocate_device(RC_DRIVER_IR_RAW);
>     194         if (!tt || !rc || buffer) {
> 
> This ! in !buffer is missing.

Yep, that's wrong.

Thank you for reporting, this obviously breaks the driver.

Sean

> 
>     195                 ret = -ENOMEM;
>     196                 goto out;
>     197         }
>     198         tt->bulk_buffer = buffer;
>     199 
>     200         /* find the correct alt setting */
>     201         for (i = 0; i < intf->num_altsetting && altsetting == -1; i++) {
>     202                 int max_packet, bulk_out_endp = -1, iso_in_endp = -1;
>     203 
>     204                 idesc = &intf->altsetting[i].desc;
>     205 
>     206                 for (j = 0; j < idesc->bNumEndpoints; j++) {
>     207                         desc = &intf->altsetting[i].endpoint[j].desc;
>     208                         max_packet = le16_to_cpu(desc->wMaxPacketSize);
>     209                         if (usb_endpoint_dir_in(desc) &&
>     210                                         usb_endpoint_xfer_isoc(desc) &&
>     211                                         max_packet == 0x10)
>     212                                 iso_in_endp = j;
>     213                         else if (usb_endpoint_dir_out(desc) &&
>     214                                         usb_endpoint_xfer_bulk(desc) &&
>     215                                         max_packet == 0x20)
>     216                                 bulk_out_endp = j;
>     217 
>     218                         if (bulk_out_endp != -1 && iso_in_endp != -1) {
>     219                                 tt->bulk_out_endp = bulk_out_endp;
>     220                                 tt->iso_in_endp = iso_in_endp;
>     221                                 altsetting = i;
>     222                                 break;
>     223                         }
>     224                 }
>     225         }
>     226 
>     227         if (altsetting == -1) {
>     228                 dev_err(&intf->dev, "cannot find expected altsetting\n");
>     229                 ret = -ENODEV;
>     230                 goto out;
>     231         }
>     232 
>     233         tt->dev = &intf->dev;
>     234         tt->udev = interface_to_usbdev(intf);
>     235         tt->rc = rc;
>     236 
>     237         ret = usb_set_interface(tt->udev, 0, altsetting);
>     238         if (ret)
>     239                 goto out;
>     240 
>     241         for (i = 0; i < NUM_URBS; i++) {
>     242                 struct urb *urb = usb_alloc_urb(8, GFP_KERNEL);
>     243                 void *buffer;
>     244 
>     245                 if (!urb) {
>     246                         ret = -ENOMEM;
>     247                         goto out;
>     248                 }
>     249 
>     250                 urb->dev = tt->udev;
>     251                 urb->context = tt;
>     252                 urb->pipe = usb_rcvisocpipe(tt->udev, tt->iso_in_endp);
>     253                 urb->interval = 1;
>     254                 buffer = usb_alloc_coherent(tt->udev, 128, GFP_KERNEL,
>     255                                                 &urb->transfer_dma);
>     256                 if (!buffer) {
>     257                         usb_free_urb(urb);
>     258                         ret = -ENOMEM;
>     259                         goto out;
>     260                 }
>     261                 urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP | URB_ISO_ASAP;
>     262                 urb->transfer_buffer = buffer;
>     263                 urb->complete = ttusbir_urb_complete;
>     264                 urb->number_of_packets = 8;
>     265                 urb->transfer_buffer_length = 128;
>     266 
>     267                 for (j = 0; j < 8; j++) {
>     268                         urb->iso_frame_desc[j].offset = j * 16;
>     269                         urb->iso_frame_desc[j].length = 16;
>     270                 }
>     271 
>     272                 tt->urb[i] = urb;
>     273         }
>     274 
>     275         tt->bulk_urb = usb_alloc_urb(0, GFP_KERNEL);
>     276         if (!tt->bulk_urb) {
>     277                 ret = -ENOMEM;
>     278                 goto out;
>     279         }
>     280 
> --> 281         tt->bulk_buffer[0] = 0xaa;
>                 ^^^^^^^^^^^^^^^^^^
> 
>     282         tt->bulk_buffer[1] = 0x01;
> 
> This email is a free service from the Smatch-CI project [smatch.sf.net].
> 
> regards,
> dan carpenter