linux-kernel - Re: [RFC PATCH] iio: ak8975: Make sure chipset is always initialized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1421685827.4459.397.camel@spandruv-desktop.jf.intel.com>
Date:	Mon, 19 Jan 2015 16:44:31 +0000
From:	"Pandruvada, Srinivas" <srinivas.pandruvada@...el.com>
To:	"Baluta, Daniel" <daniel.baluta@...el.com>
CC:	"lars@...afoo.de" <lars@...afoo.de>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"knaack.h@....de" <knaack.h@....de>,
	"jic23@...nel.org" <jic23@...nel.org>,
	"Purdila, Octavian" <octavian.purdila@...el.com>,
	"linux-iio@...r.kernel.org" <linux-iio@...r.kernel.org>,
	"Westerberg, Mika" <mika.westerberg@...el.com>,
	"pmeerw@...erw.net" <pmeerw@...erw.net>,
	"beomho.seo@...sung.com" <beomho.seo@...sung.com>,
	"gwendal@...omium.org" <gwendal@...omium.org>
Subject: Re: [RFC PATCH] iio: ak8975: Make sure chipset is always initialized

On Mon, 2015-01-19 at 16:40 +0200, Daniel Baluta wrote: 
> Hello,
> 
> On Sat, Dec 20, 2014 at 11:29 PM, Pandruvada, Srinivas
> <srinivas.pandruvada@...el.com> wrote:
> > +Mika
> >
> > On Sat, 2014-12-20 at 13:26 -0800, Srinivas Pandruvada wrote:
> >> On Sat, 2014-12-20 at 00:25 +0200, Daniel Baluta wrote:
> >> > On Sat, Dec 20, 2014 at 12:16 AM, Hartmut Knaack <knaack.h@....de> wrote:
> >> > > Daniel Baluta schrieb am 18.12.2014 um 18:16:
> >> > >> When using ACPI, if acpi_match_device fails then chipset enum will be
> >> > >> uninitialized and &ak_def_array[chipset] will point to some bad address.
> >> > >>
> >> I am missing something. You are enumerated over i2c device, which was
> >> created from ACPI PNP resource. There is a valid handle or and the
> >> device has an ACPI companion at the least. If this failing, I have to
> >> check the code for acpi i2c.
> >> Can you check why this check failed? We may have bug in i2c handling.
> 
> You are right about this. Under normal circumstances, if probe is called
> then acpi_match_device will not fail. I even tried to remove the
> device after probe
> but before acpi_match_device, anyhow acpi_match_device was still successful :)
> 
> This is more a matter of code correctness.
> 
> In ak8975_match_acpi_device we have:
> 
> »       const struct acpi_device_id *id;
> 
> »       id = acpi_match_device(dev->driver->acpi_match_table, dev);
> »       if (!id)
> »       »       return NULL;
> »       *chipset = (int)id->driver_data;
> 
> Compiler complains on the fact that chipset might be uninitialized
> if this returns NULL, and we shouldn't ignore this warning even this case
> will never happen.
> 
Will this fix?
data->chipset = AK8975;
before
ak8975_match_acpi_device(&client->dev, &data->chipset);

Thanks,
Srinivas 
> We could use some code injection techniques to force acpi_match_device
> to return NULL tough.
> 
> >> > >> This fixes the following compilation warning:
> >> > >>
> >> > >> drivers/iio/magnetometer/ak8975.c: In function ‘ak8975_probe’:
> >> > >> drivers/iio/magnetometer/ak8975.c:788:14: warning: ‘chipset’ may be used
> >> > >> uninitialized in this function [-Wmaybe-uninitialized]
> >> > >>   data->def =ak_def_array[chipset];
> >> > >>
> >> > >> Reported-by: Octavian Purdila <octavian.purdila@...el.com>
> >> > >> Signed-off-by: Daniel Baluta <daniel.baluta@...el.com>
> >> > >> ---
> >> > >> This is a RFC because while I'm pretty sure that chipset should be initialized
> >> > >> with AK_MAX_TYPE in ak8975_match_acpi_device, I am not sure if we can live with
> >> > >> a NULL return value of ak8975_match_acpi_device. Current implementation ignores
> >> > >> return value of ak8975_match_acpi_device.
> >> > > This seems to be the actual problem: these _match_acpi_device functions return
> >> > > NULL on failure, and this should be checked for.
> >> >
> >> > Ok, so this would acceptable?
> >> >
> >> > diff --git a/drivers/iio/magnetometer/ak8975.c
> >> > b/drivers/iio/magnetometer/ak8975.c
> >> > index 0d10a4b..68d99e9 100644
> >> > --- a/drivers/iio/magnetometer/ak8975.c
> >> > +++ b/drivers/iio/magnetometer/ak8975.c
> >> > @@ -776,8 +776,9 @@ static int ak8975_probe(struct i2c_client *client,
> >> >                 name = id->name;
> >> >         } else if (ACPI_HANDLE(&client->dev))
> >> >                 name = ak8975_match_acpi_device(&client->dev, &chipset);
> >> > -       else
> >> > -               return -ENOSYS;
> >> > +
> >> > +       if (!name)
> >> > +               return -ENODEV;
> >> >
> >> >
> >> > I still have some doubts about return code in case of error.
> >> >
> >> > For ak8975 we use -ENOSYS, but for kxcjk-1013 we use -ENODEV.
> >> >
> >> > I will send a patch after we clear this out.
> >> >
> >> > thanks,
> >> > Daniel.
> >>
> >