Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 17 Nov 2022 14:50:38 +0100
From:   Wolfram Sang <wsa+renesas@sang-engineering.com>
To:     Anastasia Belova <abelova@astralinux.ru>
Cc:     Ulf Hansson <ulf.hansson@linaro.org>,
        Geert Uytterhoeven <geert+renesas@glider.be>,
        Jiasheng Jiang <jiasheng@iscas.ac.cn>,
        Teppei Kamijou <teppei.kamijou.yb@renesas.com>,
        Guennadi Liakhovetski <g.liakhovetski@gmx.de>,
        Shinya Kuribayashi <shinya.kuribayashi.px@renesas.com>,
        Chris Ball <cjb@laptop.org>,
        "open list:MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND..." 
        <linux-mmc@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        lvc-project@linuxtesting.org
Subject: Re: [PATCH] mmc: sh_mmcif: Add check for NULL for host->chan_yx and
 host->chan_rx in sh_mmcif_end_cmd
Message-ID: <Y3Y8LvvaOQ/n7pg9@ninjato>
Mail-Followup-To: Wolfram Sang <wsa+renesas@sang-engineering.com>,
        Anastasia Belova <abelova@astralinux.ru>,
        Ulf Hansson <ulf.hansson@linaro.org>,
        Geert Uytterhoeven <geert+renesas@glider.be>,
        Jiasheng Jiang <jiasheng@iscas.ac.cn>,
        Teppei Kamijou <teppei.kamijou.yb@renesas.com>,
        Guennadi Liakhovetski <g.liakhovetski@gmx.de>,
        Shinya Kuribayashi <shinya.kuribayashi.px@renesas.com>,
        Chris Ball <cjb@laptop.org>,
        "open list:MULTIMEDIA CARD (MMC), SECURE DIGITAL (SD) AND..." <linux-mmc@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        lvc-project@linuxtesting.org
References: <20221117123007.13071-1-abelova@astralinux.ru>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="nqyIQIYOFD+6jl/f"
Content-Disposition: inline
In-Reply-To: <20221117123007.13071-1-abelova@astralinux.ru>
Precedence: bulk


--nqyIQIYOFD+6jl/f
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Nov 17, 2022 at 03:30:07PM +0300, Anastasia Belova wrote:
> Without these checks NULL-pointer may be dereferenced in
> sh_mmcif_end_cmd parameters inside if (data->flags & MMC_DATA_READ).
>=20
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

Is there a code path actually triggering it? I wonder because it seems
to me the check for valid channels is already done a little above when
DMA is started. And I'd assume once DMA has been started we can take for
granted that we have a valid channel when unmapping. But maybe I am
missing some error codepath?


--nqyIQIYOFD+6jl/f
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmN2PCkACgkQFA3kzBSg
Kbbs9hAAl+dK8Jq2FdvPUYK2U8h4bOOr+XZ+tAEGMibNs4Rm4onGruLDOb8oa1GR
vA9Qy2SvV8P5ev1aQYgn5pzNWc8UHAdg4iNOt4d3eZQvhcw+jTNW0JTMyUnwb2A2
Kfm8u+6hjYF3pwsvv2hDO/XiJQxleG8rhCVPqZtQcMPYuxrjh4BhEL4rtmBT1auC
5zCiLT0FHCic2XzMRrGwuaX5p/AgsZ79RwnHzwUl9N8muED31BeVDw6iGCjNYNxw
dUteqPU+YlRjytRJSbkOfsYjRM+Eq3P9GoUAcLtjsgVayvwmx5YgsUdh83mqsGXe
+I37UOAywYPAL8ejithAMX1du9oR8RXzUAJb0tvYcjmIDE7TC2llt2mVU3bi7ZQA
1b1e539VscSHXD117lPEGa78b0OIs6+fxetyG4aqsU2/up9jadv4KRP5qW2zW8cu
yVlU3ydsKD72JPiHqLWX0wOjEDyko0pojW7gTrJa8pSophMnaEgTqNVcvDb2DGDY
zNFwX0CceXeuKRK0TqdUodQpDtZrMcBRHwEbJUQwYEt3c1rmT8tatIqZvKLxicLm
QHYCvIq0TObSxnE9vhy86xbiPB2ngVXssw5eRcBZhHeB8CTef2Npbh9wuqtnVOzS
HP34Y9qoocP9V+RauqUb8Ex63V+dQInStJ8atpmVZRoxTqXNxEA=
=IGZL
-----END PGP SIGNATURE-----

--nqyIQIYOFD+6jl/f--