drivers: spi_rtio: Fix potential null pointer dereference

sudarsan-22 · danieldegrasse · commit 6efb1b40ce34 · 2025-06-27T09:58:33.000-05:00
Avoid accessing tx_bufs or rx_bufs when they are NULL by adding proper
conditional checks before dereferencing. This addresses Coverity issue

CID 516225 (CWE-476).

Signed-off-by: sudarsan N &lt;sudarsansamy2002@gmail.com&gt;
diff --git a/drivers/spi/spi_rtio.c b/drivers/spi/spi_rtio.c
@@ -192,7 +192,7 @@ int spi_rtio_copy(struct rtio *r,
 		rx_len = rx_bufs->buffers[rx].len;
 	} else {
 		rx_buf = NULL;
-		rx_len = tx_bufs->buffers[tx].len;
+		rx_len = (tx_bufs != NULL && tx < tx_count) ? tx_bufs->buffers[tx].len : 0;
 	}
 
 

Original file line number	Diff line number	Diff line change
`@@ -192,7 +192,7 @@ int spi_rtio_copy(struct rtio *r,`
`192`	`192`	`rx_len = rx_bufs->buffers[rx].len;`
`193`	`193`	`} else {`
`194`	`194`	`rx_buf = NULL;`
`195`		`- rx_len = tx_bufs->buffers[tx].len;`
	`195`	`+ rx_len = (tx_bufs != NULL && tx < tx_count) ? tx_bufs->buffers[tx].len : 0;`
`196`	`196`	`}`
`197`	`197`
`198`	`198`