linux-kernel - drivers/gpu/drm/xlnx/zynqmp_dp.c:997 zynqmp_dp_aux_cmd_submit() error: we previously assumed 'buf' could be null (see line 966)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <202106100353.e6wuQ23n-lkp@intel.com>
Date:   Thu, 10 Jun 2021 09:34:37 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Hyun Kwon <hyun.kwon@...inx.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org,
        Laurent Pinchart <laurent.pinchart@...asonboard.com>
Subject: drivers/gpu/drm/xlnx/zynqmp_dp.c:997 zynqmp_dp_aux_cmd_submit()
 error: we previously assumed 'buf' could be null (see line 966)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   368094df48e680fa51cedb68537408cfa64b788e
commit: d76271d22694e874ed70791702db9252ffe96a4c drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem
config: h8300-randconfig-m031-20210609 (attached as .config)
compiler: h8300-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/gpu/drm/xlnx/zynqmp_dp.c:997 zynqmp_dp_aux_cmd_submit() error: we previously assumed 'buf' could be null (see line 966)

vim +/buf +997 drivers/gpu/drm/xlnx/zynqmp_dp.c

d76271d22694e8 Hyun Kwon 2018-07-07   949  static int zynqmp_dp_aux_cmd_submit(struct zynqmp_dp *dp, u32 cmd, u16 addr,
d76271d22694e8 Hyun Kwon 2018-07-07   950  				    u8 *buf, u8 bytes, u8 *reply)
d76271d22694e8 Hyun Kwon 2018-07-07   951  {
d76271d22694e8 Hyun Kwon 2018-07-07   952  	bool is_read = (cmd & AUX_READ_BIT) ? true : false;
d76271d22694e8 Hyun Kwon 2018-07-07   953  	u32 reg, i;
d76271d22694e8 Hyun Kwon 2018-07-07   954  
d76271d22694e8 Hyun Kwon 2018-07-07   955  	reg = zynqmp_dp_read(dp, ZYNQMP_DP_INTERRUPT_SIGNAL_STATE);
d76271d22694e8 Hyun Kwon 2018-07-07   956  	if (reg & ZYNQMP_DP_INTERRUPT_SIGNAL_STATE_REQUEST)
d76271d22694e8 Hyun Kwon 2018-07-07   957  		return -EBUSY;
d76271d22694e8 Hyun Kwon 2018-07-07   958  
d76271d22694e8 Hyun Kwon 2018-07-07   959  	zynqmp_dp_write(dp, ZYNQMP_DP_AUX_ADDRESS, addr);
d76271d22694e8 Hyun Kwon 2018-07-07   960  	if (!is_read)
d76271d22694e8 Hyun Kwon 2018-07-07   961  		for (i = 0; i < bytes; i++)
d76271d22694e8 Hyun Kwon 2018-07-07   962  			zynqmp_dp_write(dp, ZYNQMP_DP_AUX_WRITE_FIFO,
d76271d22694e8 Hyun Kwon 2018-07-07   963  					buf[i]);
                                                                                ^^^^^^
d76271d22694e8 Hyun Kwon 2018-07-07   964  
d76271d22694e8 Hyun Kwon 2018-07-07   965  	reg = cmd << ZYNQMP_DP_AUX_COMMAND_CMD_SHIFT;
d76271d22694e8 Hyun Kwon 2018-07-07  @966  	if (!buf || !bytes)

Obviously when bytes is zero then buf is NULL etc...  This is false
positive so you can ignore it if you want, but another option would be
to just check "bytes" here.  if (!bytes) is the same as if (!buf).

d76271d22694e8 Hyun Kwon 2018-07-07   967  		reg |= ZYNQMP_DP_AUX_COMMAND_ADDRESS_ONLY;
d76271d22694e8 Hyun Kwon 2018-07-07   968  	else
d76271d22694e8 Hyun Kwon 2018-07-07   969  		reg |= (bytes - 1) << ZYNQMP_DP_AUX_COMMAND_BYTES_SHIFT;
d76271d22694e8 Hyun Kwon 2018-07-07   970  	zynqmp_dp_write(dp, ZYNQMP_DP_AUX_COMMAND, reg);
d76271d22694e8 Hyun Kwon 2018-07-07   971  
d76271d22694e8 Hyun Kwon 2018-07-07   972  	/* Wait for reply to be delivered upto 2ms */
d76271d22694e8 Hyun Kwon 2018-07-07   973  	for (i = 0; ; i++) {
d76271d22694e8 Hyun Kwon 2018-07-07   974  		reg = zynqmp_dp_read(dp, ZYNQMP_DP_INTERRUPT_SIGNAL_STATE);
d76271d22694e8 Hyun Kwon 2018-07-07   975  		if (reg & ZYNQMP_DP_INTERRUPT_SIGNAL_STATE_REPLY)
d76271d22694e8 Hyun Kwon 2018-07-07   976  			break;
d76271d22694e8 Hyun Kwon 2018-07-07   977  
d76271d22694e8 Hyun Kwon 2018-07-07   978  		if (reg & ZYNQMP_DP_INTERRUPT_SIGNAL_STATE_REPLY_TIMEOUT ||
d76271d22694e8 Hyun Kwon 2018-07-07   979  		    i == 2)
d76271d22694e8 Hyun Kwon 2018-07-07   980  			return -ETIMEDOUT;
d76271d22694e8 Hyun Kwon 2018-07-07   981  
d76271d22694e8 Hyun Kwon 2018-07-07   982  		usleep_range(1000, 1100);
d76271d22694e8 Hyun Kwon 2018-07-07   983  	}
d76271d22694e8 Hyun Kwon 2018-07-07   984  
d76271d22694e8 Hyun Kwon 2018-07-07   985  	reg = zynqmp_dp_read(dp, ZYNQMP_DP_AUX_REPLY_CODE);
d76271d22694e8 Hyun Kwon 2018-07-07   986  	if (reply)
d76271d22694e8 Hyun Kwon 2018-07-07   987  		*reply = reg;
d76271d22694e8 Hyun Kwon 2018-07-07   988  
d76271d22694e8 Hyun Kwon 2018-07-07   989  	if (is_read &&
d76271d22694e8 Hyun Kwon 2018-07-07   990  	    (reg == ZYNQMP_DP_AUX_REPLY_CODE_AUX_ACK ||
d76271d22694e8 Hyun Kwon 2018-07-07   991  	     reg == ZYNQMP_DP_AUX_REPLY_CODE_I2C_ACK)) {
d76271d22694e8 Hyun Kwon 2018-07-07   992  		reg = zynqmp_dp_read(dp, ZYNQMP_DP_REPLY_DATA_COUNT);
d76271d22694e8 Hyun Kwon 2018-07-07   993  		if ((reg & ZYNQMP_DP_REPLY_DATA_COUNT_MASK) != bytes)
d76271d22694e8 Hyun Kwon 2018-07-07   994  			return -EIO;
d76271d22694e8 Hyun Kwon 2018-07-07   995  
d76271d22694e8 Hyun Kwon 2018-07-07   996  		for (i = 0; i < bytes; i++)
d76271d22694e8 Hyun Kwon 2018-07-07  @997  			buf[i] = zynqmp_dp_read(dp, ZYNQMP_DP_AUX_REPLY_DATA);
d76271d22694e8 Hyun Kwon 2018-07-07   998  	}
d76271d22694e8 Hyun Kwon 2018-07-07   999  
d76271d22694e8 Hyun Kwon 2018-07-07  1000  	return 0;
d76271d22694e8 Hyun Kwon 2018-07-07  1001  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org