dma_mapping_error() dereferenced dev->dma_mask unconditionally, while the neighbouring cpu_to_dma()/dma_to_cpu() helpers already guard with 'dev &&'. Callers with no device (e.g. the PBL SDHCI layer, which has no mci/device yet) thus dereferenced a NULL pointer. Guard the dereference.
Assisted-by: Claude Opus 4.8 (1M context) Signed-off-by: Johannes Schneider <[email protected]> --- include/dma.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/dma.h b/include/dma.h index b8016c2e89..8f8ac78cdc 100644 --- a/include/dma.h +++ b/include/dma.h @@ -70,7 +70,7 @@ static inline void dma_set_mask(struct device *dev, u64 dma_mask) static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr) { return dma_addr == DMA_ERROR_CODE || - (dev->dma_mask && dma_addr > dev->dma_mask); + (dev && dev->dma_mask && dma_addr > dev->dma_mask); } static inline dma_addr_t cpu_to_dma(struct device *dev, void *cpu_addr) base-commit: da91ab6cb505fb09415bf8df3fae552e7b37c5e1 -- 2.43.0
