linux-kernel - RE: [PATCH][usb-next] usb: cdns3: fix missing assignment of ret before error check on ret

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 3 Sep 2019 03:29:50 +0000
From:   Pawel Laszczak <pawell@...ence.com>
To:     Colin King <colin.king@...onical.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Felipe Balbi <felipe.balbi@...ux.intel.com>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>
CC:     "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH][usb-next] usb: cdns3: fix missing assignment of ret
 before error check on ret

Hi Colin

>Hi Colin
>
>>
>>From: Colin Ian King <colin.king@...onical.com>
>>
>>Currently the check on a non-zero return code in ret is false because
>>ret has been initialized to zero.  I believe that ret should be assigned
>>to the return from the call to readl_poll_timeout_atomic before the
>>check on ret.  Since ret is being re-assinged the original initialization
>>of ret to zero can be removed.
>
>Thanks you for letting me know.
>Fortunately that's not a critical bug and has no impact for driver.
>I will correct it.
>
>Cheers
>Pawell
>
>>
>>Addresses-Coverity: ("'Constant' variable guards dead code")
>>Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
>>Signed-off-by: Colin Ian King <colin.king@...onical.com>
>>---
>> drivers/usb/cdns3/gadget.c | 6 +++---
>> 1 file changed, 3 insertions(+), 3 deletions(-)
>>
>>diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c
>>index 3094ad65ffc9..0eb3022838d6 100644
>>--- a/drivers/usb/cdns3/gadget.c
>>+++ b/drivers/usb/cdns3/gadget.c
>>@@ -2154,7 +2154,7 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep)
>> {
>> 	struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
>> 	struct usb_request *request;
>>-	int ret = 0;
>>+	int ret;
>> 	int val;
>>
>> 	trace_cdns3_halt(priv_ep, 0, 0);
>>@@ -2162,8 +2162,8 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep)
>> 	writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd);
>>
>> 	/* wait for EPRST cleared */
>>-	readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val,
>>-				  !(val & EP_CMD_EPRST), 1, 100);
>>+	ret = readl_poll_timeout_atomic(&priv_dev->regs->ep_cmd, val,
>>+					!(val & EP_CMD_EPRST), 1, 100);
>> 	if (ret)
>> 		return -EINVAL;

What about such condition:
	if (unlikely(ret)) {
		dev_err(priv_dev->dev, "Failed to clear halt %s (timeout).",
			priv_ep->name);
		return ret;
	}

Invalid return value in this place is rather impossible case. If it occurs 
then it should be treated as critical error, so it could be good to have 
information about it.

Cheers,
Pawel

>>
>
>>--
>>2.20.1