diff options
| author | Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> | 2023-08-01 00:37:42 +0300 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2023-08-01 01:22:13 +0300 |
| commit | e44222c213678d6ef646d72cbb9a2eda52f6dc22 (patch) | |
| tree | da5c5aa860cc81da67be4b7dcbdc7879927ef287 /sound/soc/sof/ipc3.c | |
| parent | 390e7066db29b985c5142513955797c1166b623a (diff) | |
| download | linux-e44222c213678d6ef646d72cbb9a2eda52f6dc22.tar.xz | |
ASoC: SOF: ipc3: add checks to prevent static analysis warnings
make KCFLAGS='-fanalyzer' sound/soc/sof/ reports an issue with memcpy:
sound/soc/sof/ipc3.c: In function ‘ipc3_wait_tx_done’:
sound/soc/sof/ipc3.c:309:33: error: use of NULL ‘reply_data’ where
non-null expected [CWE-476] [-Werror=analyzer-null-argument]
309 | memcpy(reply_data, msg->reply_data,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
310 | msg->reply_size);
The finding is legit with this call:
return sof_ipc3_tx_msg(sdev, &pm_ctx, sizeof(pm_ctx), NULL, 0, false);
Static analysis has no way of knowing that the reply will be zero-sized.
Add a check to only do the memcpy if the reply size is not zero and
the destination pointer is not NULL.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Reviewed-by: Rander Wang <rander.wang@intel.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Reviewed-by: Yaochun Hung <yc.hung@mediatek.com>
Link: https://lore.kernel.org/r/20230731213748.440285-3-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'sound/soc/sof/ipc3.c')
| -rw-r--r-- | sound/soc/sof/ipc3.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sound/soc/sof/ipc3.c b/sound/soc/sof/ipc3.c index 2c5aac31e8b0..09834205b119 100644 --- a/sound/soc/sof/ipc3.c +++ b/sound/soc/sof/ipc3.c @@ -312,7 +312,7 @@ static int ipc3_wait_tx_done(struct snd_sof_ipc *ipc, void *reply_data) } else { if (sof_debug_check_flag(SOF_DBG_PRINT_IPC_SUCCESS_LOGS)) ipc3_log_header(sdev->dev, "ipc tx succeeded", hdr->cmd); - if (msg->reply_size) + if (reply_data && msg->reply_size) /* copy the data returned from DSP */ memcpy(reply_data, msg->reply_data, msg->reply_size); |