linux-kernel - re: tty: serial: fsl_lpuart: fix DMA mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9722c1bb-f09e-7332-6381-0b423168afc7@canonical.com>
Date:   Fri, 3 Apr 2020 13:44:06 +0100
From:   Colin Ian King <colin.king@...onical.com>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Jiri Slaby <jslaby@...e.com>, linux-serial@...r.kernel.org,
        Michael Walle <michael@...le.cc>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: re: tty: serial: fsl_lpuart: fix DMA mapping - static analysis bug
 report

Hi,

Static analysis with Coverity has found an issue with the following commit:

>From a092ab25fdaa445b821f5959e458350696fce44c Mon Sep 17 00:00:00 2001
From: Michael Walle <michael@...le.cc>
Date: Fri, 6 Mar 2020 22:44:31 +0100
Subject: [PATCH] tty: serial: fsl_lpuart: fix DMA mapping

The analysis report is as follows for function lpuart_dma_rx_free in
source drivers/tty/serial/fsl_lpuart.c :

var_compare_op: Comparing chan to null implies that chan might be null.

1234        if (chan)
1235                dmaengine_terminate_all(chan);
1236

Dereference after null check (FORWARD_NULL)
var_deref_op: Dereferencing null pointer chan.

1237        dma_unmap_sg(chan->device->dev, &sport->rx_sgl, 1,
DMA_FROM_DEVICE);

The check for chan being null implies it is may be null, however, the
call to dma_unmap_sg dereferences chan which leads to a null pointer
dereference issue.

Colin