[alsa-devel] [bug report] slimbus: ngd: Add qcom SLIMBus NGD driver

[Dan Carpenter]

Hello Srinivas Kandagatla,

This is a semi-automatic email about new static checker warnings.

The patch 917809e2280b: "slimbus: ngd: Add qcom SLIMBus NGD driver" 
from Jun 19, 2018, leads to the following Smatch complaint:

    drivers/slimbus/qcom-ngd-ctrl.c:867 qcom_slim_ngd_xfer_msg()
     warn: variable dereferenced before check 'txn->msg' (see line 791)

drivers/slimbus/qcom-ngd-ctrl.c
   790	
   791		if (txn->msg->num_bytes > SLIM_MSGQ_BUF_LEN ||
                    ^^^^^^^^^
Dereference

   792				txn->rl > SLIM_MSGQ_BUF_LEN) {
   793			dev_err(ctrl->dev, "msg exeeds HW limit\n");
   794			return -EINVAL;
   795		}
   796	
   797		pbuf = qcom_slim_ngd_tx_msg_get(ctrl, txn->rl, &tx_sent);
   798		if (!pbuf) {
   799			dev_err(ctrl->dev, "Message buffer unavailable\n");
   800			return -ENOMEM;
   801		}
   802	
   803		if (txn->mt == SLIM_MSG_MT_CORE &&
   804			(txn->mc == SLIM_MSG_MC_CONNECT_SOURCE ||
   805			txn->mc == SLIM_MSG_MC_CONNECT_SINK ||
   806			txn->mc == SLIM_MSG_MC_DISCONNECT_PORT)) {
   807			txn->mt = SLIM_MSG_MT_DEST_REFERRED_USER;
   808			switch (txn->mc) {
   809			case SLIM_MSG_MC_CONNECT_SOURCE:
   810				txn->mc = SLIM_USR_MC_CONNECT_SRC;
   811				break;
   812			case SLIM_MSG_MC_CONNECT_SINK:
   813				txn->mc = SLIM_USR_MC_CONNECT_SINK;
   814				break;
   815			case SLIM_MSG_MC_DISCONNECT_PORT:
   816				txn->mc = SLIM_USR_MC_DISCONNECT_PORT;
   817				break;
   818			default:
   819				return -EINVAL;
   820			}
   821	
   822			usr_msg = true;
   823			i = 0;
   824			wbuf[i++] = txn->la;
   825			la = SLIM_LA_MGR;
   826			wbuf[i++] = txn->msg->wbuf[0];
   827			if (txn->mc != SLIM_USR_MC_DISCONNECT_PORT)
   828				wbuf[i++] = txn->msg->wbuf[1];
   829	
   830			txn->comp = &done;
   831			ret = slim_alloc_txn_tid(sctrl, txn);
   832			if (ret) {
   833				dev_err(ctrl->dev, "Unable to allocate TID\n");
   834				return ret;
   835			}
   836	
   837			wbuf[i++] = txn->tid;
   838	
   839			txn->msg->num_bytes = i;
   840			txn->msg->wbuf = wbuf;
   841			txn->msg->rbuf = rbuf;
   842			txn->rl = txn->msg->num_bytes + 4;
   843		}
   844	
   845		/* HW expects length field to be excluded */
   846		txn->rl--;
   847		puc = (u8 *)pbuf;
   848		*pbuf = 0;
   849		if (txn->dt == SLIM_MSG_DEST_LOGICALADDR) {
   850			*pbuf = SLIM_MSG_ASM_FIRST_WORD(txn->rl, txn->mt, txn->mc, 0,
   851					la);
   852			puc += 3;
   853		} else {
   854			*pbuf = SLIM_MSG_ASM_FIRST_WORD(txn->rl, txn->mt, txn->mc, 1,
   855					la);
   856			puc += 2;
   857		}
   858	
   859		if (slim_tid_txn(txn->mt, txn->mc))
   860			*(puc++) = txn->tid;
   861	
   862		if (slim_ec_txn(txn->mt, txn->mc)) {
   863			*(puc++) = (txn->ec & 0xFF);
   864			*(puc++) = (txn->ec >> 8) & 0xFF;
   865		}
   866	
   867		if (txn->msg && txn->msg->wbuf)
                    ^^^^^^^^
This check is too late.

   868			memcpy(puc, txn->msg->wbuf, txn->msg->num_bytes);
   869	

regards,
dan carpenter