linux-kernel - [PATCH] drm: msm: Check cmd_db_read_aux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181129163826.178670-1-swboyd@chromium.org>
Date:   Thu, 29 Nov 2018 08:38:26 -0800
From:   Stephen Boyd <swboyd@...omium.org>
To:     Andy Gross <andy.gross@...aro.org>
Cc:     linux-kernel@...r.kernel.org, linux-arm-msm@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        kbuild test robot <lkp@...el.com>,
        Jordan Crouse <jcrouse@...eaurora.org>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        Evan Green <evgreen@...omium.org>,
        Rob Clark <robdclark@...il.com>
Subject: [PATCH] drm: msm: Check cmd_db_read_aux_data() for failure

We need to check the call to cmd_db_read_aux_data() for the error case,
so that we don't continue and use potentially uninitialized values for
'pri_count' and 'sec_count'. Otherwise, we get the following compiler
warnings:

   drivers/gpu/drm/msm/adreno/a6xx_gmu.c: In function 'a6xx_gmu_rpmh_arc_votes_init.isra.12':
   drivers/gpu/drm/msm/adreno/a6xx_gmu.c:943:12: warning: 'pri_count' is used uninitialized in this function [-Wuninitialized]
     pri_count >>= 1;
               ^~~
   drivers/gpu/drm/msm/adreno/a6xx_gmu.c:948:12: warning: 'sec_count' may be used uninitialized in this function
[-Wmaybe-uninitialized]
     sec_count >>= 1;
               ^~~

Reported-by: Stephen Rothwell <sfr@...b.auug.org.au>
Reported-by: kbuild test robot <lkp@...el.com>
Cc: Jordan Crouse <jcrouse@...eaurora.org>
Cc: Bjorn Andersson <bjorn.andersson@...aro.org>
Cc: Evan Green <evgreen@...omium.org>
Cc: Jordan Crouse <jcrouse@...eaurora.org>
Cc: Rob Clark <robdclark@...il.com>
Fixes: ed3cafa79ea7 ("soc: qcom: cmd-db: Stop memcpy()ing in cmd_db_read_aux_data()")
Signed-off-by: Stephen Boyd <swboyd@...omium.org>
---
 drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index 8cd294e2846d..b450f7ea0422 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -936,6 +936,8 @@ static int a6xx_gmu_rpmh_arc_votes_init(struct device *dev, u32 *votes,
 	size_t pri_count, sec_count;
 
 	pri = cmd_db_read_aux_data(id, &pri_count);
+	if (IS_ERR(pri))
+		return PTR_ERR(pri);
 	/*
 	 * The data comes back as an array of unsigned shorts so adjust the
 	 * count accordingly
@@ -945,6 +947,9 @@ static int a6xx_gmu_rpmh_arc_votes_init(struct device *dev, u32 *votes,
 		return -EINVAL;
 
 	sec = cmd_db_read_aux_data("mx.lvl", &sec_count);
+	if (IS_ERR(sec))
+		return PTR_ERR(sec);
+
 	sec_count >>= 1;
 	if (!sec_count)
 		return -EINVAL;
-- 
Sent by a computer through tubes