[coreboot-gerrit] Change in coreboot[master]: soc/nvidia/tegra210: Fix potential NULL pointer dereference

[Martin Roth (Code Review)]

Martin Roth has submitted this change and it was merged. ( https://review.coreboot.org/c/coreboot/+/34787 )

Change subject: soc/nvidia/tegra210: Fix potential NULL pointer dereference
......................................................................

soc/nvidia/tegra210: Fix potential NULL pointer dereference

Recent Coverity scan indicated potential NULL deference; if either
spi->dma_in or spi->dma_out are NULL, the fifo_error() check could
dereference a NULL pointer.

Also fixed what appears to be a logic bug for the spi->dma_out case,
where it was using the todo (count) from spi->dma_in.

Found-by: Coverity CID 1241838, 1241854
Change-Id: Icd1412f0956c0a4a75266d1873d5e9848aceee32
Signed-off-by: Tim Wawrzynczak 
Reviewed-on: https://review.coreboot.org/c/coreboot/+/34787
Reviewed-by: Julius Werner 
Tested-by: build bot (Jenkins) 
---
M src/soc/nvidia/tegra210/spi.c
1 file changed, 25 insertions(+), 21 deletions(-)

Approvals:
  build bot (Jenkins): Verified
  Julius Werner: Looks good to me, approved

diff --git a/src/soc/nvidia/tegra210/spi.c b/src/soc/nvidia/tegra210/spi.c
index 9310e0c..6ec8b64 100644
--- a/src/soc/nvidia/tegra210/spi.c
+++ b/src/soc/nvidia/tegra210/spi.c
@@ -286,25 +286,27 @@

static void dump_dma_regs(struct apb_dma_channel *dma)
 {
-	printk(BIOS_INFO, "DMA regs:\n"
-			"\tahb_ptr: 0x%08x\n"
-			"\tapb_ptr: 0x%08x\n"
-			"\tahb_seq: 0x%08x\n"
-			"\tapb_seq: 0x%08x\n"
-			"\tcsr: 0x%08x\n"
-			"\tcsre: 0x%08x\n"
-			"\twcount: 0x%08x\n"
-			"\tdma_byte_sta: 0x%08x\n"
-			"\tword_transfer: 0x%08x\n",
-			read32(&dma->regs->ahb_ptr),
-			read32(&dma->regs->apb_ptr),
-			read32(&dma->regs->ahb_seq),
-			read32(&dma->regs->apb_seq),
-			read32(&dma->regs->csr),
-			read32(&dma->regs->csre),
-			read32(&dma->regs->wcount),
-			read32(&dma->regs->dma_byte_sta),
-			read32(&dma->regs->word_transfer));
+	if (dma) {
+		printk(BIOS_INFO, "DMA regs:\n"
+		       "\tahb_ptr: 0x%08x\n"
+		       "\tapb_ptr: 0x%08x\n"
+		       "\tahb_seq: 0x%08x\n"
+		       "\tapb_seq: 0x%08x\n"
+		       "\tcsr: 0x%08x\n"
+		       "\tcsre: 0x%08x\n"
+		       "\twcount: 0x%08x\n"
+		       "\tdma_byte_sta: 0x%08x\n"
+		       "\tword_transfer: 0x%08x\n",
+		       read32(&dma->regs->ahb_ptr),
+		       read32(&dma->regs->apb_ptr),
+		       read32(&dma->regs->ahb_seq),
+		       read32(&dma->regs->apb_seq),
+		       read32(&dma->regs->csr),
+		       read32(&dma->regs->csre),
+		       read32(&dma->regs->wcount),
+		       read32(&dma->regs->dma_byte_sta),
+		       read32(&dma->regs->word_transfer));
+	}
 }

static inline unsigned int spi_byte_count(struct tegra_spi_channel *spi)
@@ -574,9 +576,9 @@

struct apb_dma * const apb_dma = (struct apb_dma *)TEGRA_APB_DMA_BASE;

-	todo = read32(&spi->dma_in->regs->wcount);
-
    if (spi->dma_in) {
+		todo = read32(&spi->dma_in->regs->wcount);
+
    	while ((read32(&spi->dma_in->regs->dma_byte_sta) < todo) ||
    			dma_busy(spi->dma_in))
    		;
@@ -589,6 +591,8 @@
    }

if (spi->dma_out) {
+		todo = read32(&spi->dma_out->regs->wcount);
+
    	while ((read32(&spi->dma_out->regs->dma_byte_sta) < todo) ||
    			dma_busy(spi->dma_out))
    		;