linux-kernel - Re: [PATCH] Bluetooth: mediatek: fix uninitialized symbol errors in btmtksdio_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1552932151.24944.12.camel@mtkswgap22>
Date:   Tue, 19 Mar 2019 02:02:31 +0800
From:   Sean Wang <sean.wang@...iatek.com>
To:     Marcel Holtmann <marcel@...tmann.org>
CC:     Johan Hedberg <johan.hedberg@...il.com>,
        <linux-bluetooth@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Bluetooth: mediatek: fix uninitialized symbol errors in
 btmtksdio_rx_packet

On Mon, 2019-03-18 at 17:55 +0100, Marcel Holtmann wrote:
> Hi Sean,
> 
> > Fixed all the below warnings. They would probably cause the following
> > error handling path would use the uninitialized value and then produce
> > unexpected behavior.
> > 
> > drivers/bluetooth/btmtksdio.c:470:2: warning: ‘old_len’ may be used
> > uninitialized in this function [-Wmaybe-uninitialized]
> >  print_hex_dump(KERN_ERR, "err sdio rx: ", DUMP_PREFIX_NONE, 4, 1,
> >  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >          old_data, old_len, true);
> >          ~~~~~~~~~~~~~~~~~~~~~~~~
> > drivers/bluetooth/btmtksdio.c:376:15: note: ‘old_len’ was declared here
> >  unsigned int old_len;
> >               ^~~~~~~
> > drivers/bluetooth/btmtksdio.c:470:2: warning: ‘old_data’ may be used
> > uninitialized in this function [-Wmaybe-uninitialized]
> >  print_hex_dump(KERN_ERR, "err sdio rx: ", DUMP_PREFIX_NONE, 4, 1,
> >  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >          old_data, old_len, true);
> >          ~~~~~~~~~~~~~~~~~~~~~~~~
> > drivers/bluetooth/btmtksdio.c:375:17: note: ‘old_data’ was declared here
> >  unsigned char *old_data;
> >                 ^~~~~~~~
> > 
> > Fixes: d74eef2834b5 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices")
> > Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
> > Reported-by: Marcel Holtmann <marcel@...tmann.org>
> > Signed-off-by: Sean Wang <sean.wang@...iatek.com>
> > ---
> > drivers/bluetooth/btmtksdio.c | 4 ++--
> > 1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c
> > index b4b8320f279e..23cf63888bac 100644
> > --- a/drivers/bluetooth/btmtksdio.c
> > +++ b/drivers/bluetooth/btmtksdio.c
> > @@ -372,8 +372,8 @@ static int btmtksdio_rx_packet(struct btmtksdio_dev *bdev, u16 rx_size)
> > 	const struct h4_recv_pkt *pkts = mtk_recv_pkts;
> > 	int pkts_count = ARRAY_SIZE(mtk_recv_pkts);
> > 	struct mtkbtsdio_hdr *sdio_hdr;
> > -	unsigned char *old_data;
> > -	unsigned int old_len;
> > +	unsigned char *old_data = NULL;
> > +	unsigned int old_len = 0;
> > 	int err, i, pad_size;
> > 	struct sk_buff *skb;
> > 	u16 dlen;
> 
> or instead just remove this whole old_len + old_data stuff anyway since it is rather pointless. Or at least introduce a proper error path for sdio_readsb since you know when it fails, there is no point in writing the SKB.
> 
> Regards
> 

I will remove the old_len and old_data in the next version for the issue
because the error path for sdio_readsb seems wrong.

My initial purpose is that I would like to add a error path for these
packets which are successful at sdio_readsb but fail at packet format
parsing. I will update the error path for packet format error in
a separate patch.

> Marcel
>