[bug report] scsi: ufs: core: bsg: Add advanced RPMB support in ufs_bsg

[Dan Carpenter <error27@gmail.com>]

Hello Bean Huo,

The patch 6ff265fc5ef6: "scsi: ufs: core: bsg: Add advanced RPMB
support in ufs_bsg" from Dec 1, 2022, leads to the following Smatch
static checker warning:

	drivers/ufs/core/ufs_bsg.c:121 ufs_bsg_exec_advanced_rpmb_req()
	error: uninitialized symbol 'sg_cnt'.

drivers/ufs/core/ufs_bsg.c
    67 static int ufs_bsg_exec_advanced_rpmb_req(struct ufs_hba *hba, struct bsg_job *job)
    68 {
    69         struct ufs_rpmb_request *rpmb_request = job->request;
    70         struct ufs_rpmb_reply *rpmb_reply = job->reply;
    71         struct bsg_buffer *payload = NULL;
    72         enum dma_data_direction dir;
    73         struct scatterlist *sg_list;
    74         int rpmb_req_type;
    75         int sg_cnt;
    76         int ret;
    77         int data_len;
    78 
    79         if (hba->ufs_version < ufshci_version(4, 0) || !hba->dev_info.b_advanced_rpmb_en ||
    80             !(hba->capabilities & MASK_EHSLUTRD_SUPPORTED))
    81                 return -EINVAL;
    82 
    83         if (rpmb_request->ehs_req.length != 2 || rpmb_request->ehs_req.ehs_type != 1)
    84                 return -EINVAL;
    85 
    86         rpmb_req_type = be16_to_cpu(rpmb_request->ehs_req.meta.req_resp_type);
    87 
    88         switch (rpmb_req_type) {
    89         case UFS_RPMB_WRITE_KEY:
    90         case UFS_RPMB_READ_CNT:
    91         case UFS_RPMB_PURGE_ENABLE:
    92                 dir = DMA_NONE;
    93                 break;
    94         case UFS_RPMB_WRITE:
    95         case UFS_RPMB_SEC_CONF_WRITE:
    96                 dir = DMA_TO_DEVICE;
    97                 break;
    98         case UFS_RPMB_READ:
    99         case UFS_RPMB_SEC_CONF_READ:
    100         case UFS_RPMB_PURGE_STATUS_READ:
    101                 dir = DMA_FROM_DEVICE;
    102                 break;
    103         default:
    104                 return -EINVAL;
    105         }
    106 
    107         if (dir != DMA_NONE) {
    108                 payload = &job->request_payload;
    109                 if (!payload || !payload->payload_len || !payload->sg_cnt)
    110                         return -EINVAL;
    111 
    112                 sg_cnt = dma_map_sg(hba->host->dma_dev, payload->sg_list, payload->sg_cnt, dir);
    113                 if (unlikely(!sg_cnt))
    114                         return -ENOMEM;
    115                 sg_list = payload->sg_list;
    116                 data_len = payload->payload_len;
    117         }

"sg_cnt" not initialized on else path.

    118 
    119         ret = ufshcd_advanced_rpmb_req_handler(hba, &rpmb_request->bsg_request.upiu_req,
    120                                    &rpmb_reply->bsg_reply.upiu_rsp, &rpmb_request->ehs_req,
--> 121                                    &rpmb_reply->ehs_rsp, sg_cnt, sg_list, dir);
                                                                 ^^^^^^

    122 
    123         if (dir != DMA_NONE) {
    124                 dma_unmap_sg(hba->host->dma_dev, payload->sg_list, payload->sg_cnt, dir);
    125 
    126                 if (!ret)
    127                         rpmb_reply->bsg_reply.reply_payload_rcv_len = data_len;
    128         }
    129 
    130         return ret;
    131 }

regards,
dan carpenter