From c4f2c05ab02952c9a56067aeb700ded95b183570 Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Mon, 30 Jun 2025 10:12:53 +0200 Subject: [PATCH] spi: stm32: fix pointer-to-pointer variables usage In stm32_spi_prepare_rx_dma_mdma_chaining() both rx_dma_desc and rx_mdma_desc are passed as pointer-to-pointer arguments. The goal is to pass back to the caller the value returned by dmaengine_prep_slave_sg(), when it is not NULL. However, these variables are wrongly handled as simple pointers during later assignments and checks. Fix this behaviour by introducing two pointer variables which can then be treated accordingly. Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use") Addresses-Coverity-ID: 1644715 ("Null pointer dereferences (REVERSE_INULL)") Signed-off-by: Antonio Quartulli Reviewed-by: Clement LE GOFFIC Link: https://patch.msgid.link/20250630081253.17294-1-antonio@mandelbit.com Signed-off-by: Mark Brown --- drivers/spi/spi-stm32.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c index 858470a2cab52..9b3bc0c908bf2 100644 --- a/drivers/spi/spi-stm32.c +++ b/drivers/spi/spi-stm32.c @@ -1474,6 +1474,8 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi, struct dma_async_tx_descriptor **rx_dma_desc, struct dma_async_tx_descriptor **rx_mdma_desc) { + struct dma_async_tx_descriptor *_mdma_desc = *rx_mdma_desc; + struct dma_async_tx_descriptor *_dma_desc = *rx_dma_desc; struct dma_slave_config rx_mdma_conf = {0}; u32 sram_period, nents = 0, spi_s_len; struct sg_table dma_sgt, mdma_sgt; @@ -1524,18 +1526,18 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi, } } - *rx_dma_desc = dmaengine_prep_slave_sg(spi->dma_rx, dma_sgt.sgl, - dma_sgt.nents, rx_dma_conf->direction, - DMA_PREP_INTERRUPT); + _dma_desc = dmaengine_prep_slave_sg(spi->dma_rx, dma_sgt.sgl, + dma_sgt.nents, rx_dma_conf->direction, + DMA_PREP_INTERRUPT); sg_free_table(&dma_sgt); - if (!rx_dma_desc) + if (!_dma_desc) return -EINVAL; /* Prepare MDMA slave_sg transfer MEM_TO_MEM (SRAM>DDR) */ ret = sg_alloc_table(&mdma_sgt, nents, GFP_ATOMIC); if (ret) { - rx_dma_desc = NULL; + _dma_desc = NULL; return ret; } @@ -1558,13 +1560,13 @@ static int stm32_spi_prepare_rx_dma_mdma_chaining(struct stm32_spi *spi, } } - *rx_mdma_desc = dmaengine_prep_slave_sg(spi->mdma_rx, mdma_sgt.sgl, - mdma_sgt.nents, rx_mdma_conf.direction, - DMA_PREP_INTERRUPT); + _mdma_desc = dmaengine_prep_slave_sg(spi->mdma_rx, mdma_sgt.sgl, + mdma_sgt.nents, rx_mdma_conf.direction, + DMA_PREP_INTERRUPT); sg_free_table(&mdma_sgt); - if (!rx_mdma_desc) { - rx_dma_desc = NULL; + if (!_mdma_desc) { + _dma_desc = NULL; return -EINVAL; } -- 2.47.2