[bug report] mtd: rawnand: cadence: use dma_map_resource for sdma address

[bug report] mtd: rawnand: cadence: use dma_map_resource for sdma address

[Dan Carpenter]

Hello Niravkumar L Rabara,

This is a semi-automatic email about new static checker warnings.

Commit d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for
sdma address") from Feb 10, 2025, leads to the following Smatch
complaint:

    drivers/mtd/nand/raw/cadence-nand-controller.c:2982 cadence_nand_remove()
    warn: variable dereferenced before check 'cdns_ctrl->dmac' (see line 2975)

drivers/mtd/nand/raw/cadence-nand-controller.c
  2974		cadence_nand_chips_cleanup(cdns_ctrl);
  2975		dma_unmap_resource(cdns_ctrl->dmac->device->dev, cdns_ctrl->io.iova_dma,
                                   ^^^^^^^^^^^^^^^
The patch adds an unchecked dereference

  2976				   cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0);
  2977		cadence_nand_irq_cleanup(cdns_ctrl->irq, cdns_ctrl);
  2978		kfree(cdns_ctrl->buf);
  2979		dma_free_coherent(cdns_ctrl->dev, sizeof(struct cadence_nand_cdma_desc),
  2980				  cdns_ctrl->cdma_desc, cdns_ctrl->dma_cdma_desc);
  2981	
  2982		if (cdns_ctrl->dmac)
                    ^^^^^^^^^^^^^^^
But the old code assumed ->dmac could be NULL

  2983			dma_release_channel(cdns_ctrl->dmac);
  2984	}

regards,
dan carpenter

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

RE: [bug report] mtd: rawnand: cadence: use dma_map_resource for sdma address

[Rabara, Niravkumar L]

Hi Dan,

> -----Original Message-----
> From: Dan Carpenter <dan.carpenter@linaro.org>
> Sent: Thursday, 13 February, 2025 3:13 PM
> To: Rabara, Niravkumar L <niravkumar.l.rabara@intel.com>
> Cc: linux-mtd@lists.infradead.org
> Subject: [bug report] mtd: rawnand: cadence: use dma_map_resource for
> sdma address
> 
> Hello Niravkumar L Rabara,
> 
> This is a semi-automatic email about new static checker warnings.
> 
> Commit d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for
> sdma address") from Feb 10, 2025, leads to the following Smatch
> complaint:
> 
>     drivers/mtd/nand/raw/cadence-nand-controller.c:2982
> cadence_nand_remove()
>     warn: variable dereferenced before check 'cdns_ctrl->dmac' (see line 2975)
> 
> drivers/mtd/nand/raw/cadence-nand-controller.c
>   2974		cadence_nand_chips_cleanup(cdns_ctrl);
>   2975		dma_unmap_resource(cdns_ctrl->dmac->device->dev,
> cdns_ctrl->io.iova_dma,
>                                    ^^^^^^^^^^^^^^^ The patch adds an unchecked
> dereference
> 
>   2976				   cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0);
>   2977		cadence_nand_irq_cleanup(cdns_ctrl->irq, cdns_ctrl);
>   2978		kfree(cdns_ctrl->buf);
>   2979		dma_free_coherent(cdns_ctrl->dev, sizeof(struct
> cadence_nand_cdma_desc),
>   2980				  cdns_ctrl->cdma_desc, cdns_ctrl-
> >dma_cdma_desc);
>   2981
>   2982		if (cdns_ctrl->dmac)
>                     ^^^^^^^^^^^^^^^
> But the old code assumed ->dmac could be NULL
> 
>   2983			dma_release_channel(cdns_ctrl->dmac);
>   2984	}
> 

I missed this.
I will add a NULL check before the dma_unmap_resource()

if (cdns_ctrl->dmac)
	dma_unmap_resource(cdns_ctrl->dmac->device->dev, cdns_ctrl->io.iova_dma,
			   cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0);

Shall I submit a new version of this patch?
Do I need to include any additional tag or info? 

Thanks,
Nirav 

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

Re: [bug report] mtd: rawnand: cadence: use dma_map_resource for sdma address

[Dan Carpenter]

On Thu, Feb 13, 2025 at 07:33:49AM +0000, Rabara, Niravkumar L wrote:
> 
> I missed this.
> I will add a NULL check before the dma_unmap_resource()
> 
> if (cdns_ctrl->dmac)
> 	dma_unmap_resource(cdns_ctrl->dmac->device->dev, cdns_ctrl->io.iova_dma,
> 			   cdns_ctrl->io.size, DMA_BIDIRECTIONAL, 0);
> 
> Shall I submit a new version of this patch?
> Do I need to include any additional tag or info? 

I don't really know how it's handled in mtd.

Generally, I would send a patch just to fix the bug.  You would want to
have a Fixes tag and a Reported-by tag.  Some subsystems fold fixes into
the original commit before sending and some don't.  Either way, the
maintainer can figure it out.

regards,
dan carpenter


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/