soc/nvidia/tegra210: Fix potential NULL pointer dereference
Recent Coverity scan indicated potential NULL deference; if either spi->dma_in or spi->dma_out are NULL, the fifo_error() check could dereference a NULL pointer. Also fixed what appears to be a logic bug for the spi->dma_out case, where it was using the todo (count) from spi->dma_in. Found-by: Coverity CID 1241838, 1241854 Change-Id: Icd1412f0956c0a4a75266d1873d5e9848aceee32 Signed-off-by: Tim Wawrzynczak <twawrzynczak@chromium.org> Reviewed-on: https://review.coreboot.org/c/coreboot/+/34787 Reviewed-by: Julius Werner <jwerner@chromium.org> Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
This commit is contained in:
parent
98f43a1f75
commit
680027edf6
|
@ -286,6 +286,7 @@ static void dump_spi_regs(struct tegra_spi_channel *spi)
|
|||
|
||||
static void dump_dma_regs(struct apb_dma_channel *dma)
|
||||
{
|
||||
if (dma) {
|
||||
printk(BIOS_INFO, "DMA regs:\n"
|
||||
"\tahb_ptr: 0x%08x\n"
|
||||
"\tapb_ptr: 0x%08x\n"
|
||||
|
@ -306,6 +307,7 @@ static void dump_dma_regs(struct apb_dma_channel *dma)
|
|||
read32(&dma->regs->dma_byte_sta),
|
||||
read32(&dma->regs->word_transfer));
|
||||
}
|
||||
}
|
||||
|
||||
static inline unsigned int spi_byte_count(struct tegra_spi_channel *spi)
|
||||
{
|
||||
|
@ -574,9 +576,9 @@ static int tegra_spi_dma_finish(struct tegra_spi_channel *spi)
|
|||
|
||||
struct apb_dma * const apb_dma = (struct apb_dma *)TEGRA_APB_DMA_BASE;
|
||||
|
||||
if (spi->dma_in) {
|
||||
todo = read32(&spi->dma_in->regs->wcount);
|
||||
|
||||
if (spi->dma_in) {
|
||||
while ((read32(&spi->dma_in->regs->dma_byte_sta) < todo) ||
|
||||
dma_busy(spi->dma_in))
|
||||
;
|
||||
|
@ -589,6 +591,8 @@ static int tegra_spi_dma_finish(struct tegra_spi_channel *spi)
|
|||
}
|
||||
|
||||
if (spi->dma_out) {
|
||||
todo = read32(&spi->dma_out->regs->wcount);
|
||||
|
||||
while ((read32(&spi->dma_out->regs->dma_byte_sta) < todo) ||
|
||||
dma_busy(spi->dma_out))
|
||||
;
|
||||
|
|
Loading…
Reference in New Issue