On Thu, Jul 31, 2025 at 12:11:47PM +0100, Andrew Goodbody wrote:
>In owl_mmc_prepare_data there is a NULL check for the pointer data but
>it happens after data has already been dereferenced. Refactor the code
>so that the NULL check happens before any code dereferences data.
>
>This issue was found by Smatch.
>
>Signed-off-by: Andrew Goodbody <andrew.goodb...@linaro.org>
>---
> drivers/mmc/owl_mmc.c | 18 +++++++++---------
> 1 file changed, 9 insertions(+), 9 deletions(-)
>
>diff --git a/drivers/mmc/owl_mmc.c b/drivers/mmc/owl_mmc.c
>index bd4906f58e7..c18807b1f49 100644
>--- a/drivers/mmc/owl_mmc.c
>+++ b/drivers/mmc/owl_mmc.c
>@@ -135,19 +135,19 @@ static void owl_mmc_prepare_data(struct owl_mmc_priv
>*priv,
>
> setbits_le32(priv->reg_base + OWL_REG_SD_EN, OWL_SD_EN_BSEL);
>
>- writel(data->blocks, priv->reg_base + OWL_REG_SD_BLK_NUM);
>- writel(data->blocksize, priv->reg_base + OWL_REG_SD_BLK_SIZE);
>- total = data->blocksize * data->blocks;
>-
>- if (total < 512)
>- writel(total, priv->reg_base + OWL_REG_SD_BUF_SIZE);
>- else
>- writel(512, priv->reg_base + OWL_REG_SD_BUF_SIZE);
>-
> /* DMA STOP */
> writel(0x0, SD_DMA_CHANNEL(priv->dma_channel, 0) + DMA_START);
>
> if (data) {
>+ writel(data->blocks, priv->reg_base + OWL_REG_SD_BLK_NUM);
>+ writel(data->blocksize, priv->reg_base + OWL_REG_SD_BLK_SIZE);
>+ total = data->blocksize * data->blocks;
>+
>+ if (total < 512)
>+ writel(total, priv->reg_base + OWL_REG_SD_BUF_SIZE);
>+ else
>+ writel(512, priv->reg_base + OWL_REG_SD_BUF_SIZE);
>+
This piece code is moved to after 'DMA STOP', so code logic is changed.
This may not be expected.
Thanks,
Peng
> if (data->flags == MMC_DATA_READ) {
> buf = (ulong) (data->dest);
> owl_dma_config(priv, (ulong) priv->reg_base +
>
>---
>base-commit: 79f3e77133bd7248e4579827effc13f97a32a8a8
>change-id: 20250731-owl_mmc-ef16e32b68fd
>
>Best regards,
>--
>Andrew Goodbody <andrew.goodb...@linaro.org>
>
