| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <17405149.YoMEP5XZXy@linux.local>
Date: Wed, 14 Apr 2021 09:59:36 +0200
From: "Fabio M. De Francesco" <fmdefrancesco@...il.com>
To: Dan Carpenter <dan.carpenter@...cle.com>
Cc: Matthew Wilcox <willy@...radead.org>,
Julia Lawall <julia.lawall@...ia.fr>,
outreachy-kernel@...glegroups.com,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [Outreachy kernel] [PATCH] :staging: rtl8723bs: Remove useless led_blink_hdl()
On Wednesday, April 14, 2021 9:00:25 AM CEST Dan Carpenter wrote:
> On Wed, Apr 14, 2021 at 08:33:48AM +0200, Fabio M. De Francesco wrote:
> > On Wednesday, April 14, 2021 7:21:50 AM CEST Dan Carpenter wrote:
> > > On Tue, Apr 13, 2021 at 10:08:32PM +0200, Fabio M. De Francesco
wrote:
> > > > On Tuesday, April 13, 2021 9:48:44 PM CEST Matthew Wilcox wrote:
> > > > > On Tue, Apr 13, 2021 at 09:45:03PM +0200, Fabio M. De Francesco
> >
> > wrote:
> > > > > > 1) The driver doesn't call that function from anywhere else
> > > > > > than
> > > > > > the
> > > > > > macro. 2) You have explained that the macro add its symbol to a
> > > > > > slot
> > > > > > in an array that would shift all the subsequent elements down
> > > > > > if
> > > > > > that
> > > > > > macro is not used exactly in the line where it is.
> > > > > > 3) Dan Carpenter said that that array is full of null functions
> > > > > > (or
> > > > > > empty slots?).
> > > > > >
> > > > > > Unless that function is called anonymously dereferencing its
> > > > > > address
> > > > > > from the position it occupies in the array, I'm not able to see
> > > > > > what
> > > > > > else means can any caller use.
> > > > > >
> > > > > > I know I have much less experience than you with C: what can go
> > > > > > wrong?
> > > > >
> > > > > Here's where the driver calls that function:
> > > > >
> > > > > $ git grep wlancmds drivers/staging/rtl8723bs/
> > > > > drivers/staging/rtl8723bs/core/rtw_cmd.c:static struct cmd_hdl
> > > > >
> > > > > wlancmds[] = { drivers/staging/rtl8723bs/core/rtw_cmd.c:
> > > > > if
> > > > >
> > > > > (pcmd->cmdcode < ARRAY_SIZE(wlancmds)) {
> > > > > drivers/staging/rtl8723bs/core/rtw_cmd.c:
> > > > > cmd_hdl
> > > > > = wlancmds[pcmd->cmdcode].h2cfuns;
> > > >
> > > > OK, I had imagined an anonymous call from its location in the array
> > > > (as
> > > > I wrote in the last phrase of my message). However, I thought that
> > > > it
> > > > could have been an improbable possibility, not a real one.
> > > >
> > > > Linux uses a lot of interesting ideas that newcomers like me should
> > > > learn. Things here are trickier than they appear at first sight.
> > >
> > > One trick would be to build the Smatch cross function database.
> > >
> > > https://www.spinics.net/lists/smatch/msg00568.html
> > >
> > > Then you could do:
> > >
> > > $ ~/path/to/smatch_data/db/smdb.py led_blink_hdl
> > > file | caller | function | type | parameter | key | value |
> > > drivers/staging/rtl8723bs/core/rtw_cmd.c | rtw_cmd_thread |
> > > rtw_cmd_thread ptr cmd_hdl | INTERNAL | -1 |
> > > |
> > > uchar(*)(struct adapter*, uchar*)
> > > drivers/staging/rtl8188eu/core/rtw_cmd.c | rtw_cmd_thread |
> > > rtw_cmd_thread ptr cmd_hdl | INTERNAL | -1 |
> > > |
> > > uchar(*)(struct adapter*, uchar*)
> > > drivers/staging/rtl8188eu/core/rtw_cmd.c | rtw_cmd_thread |
> > > rtw_cmd_thread ptr cmd_hdl | BUF_SIZE | 1 |
> > > pbuf |
> > > 1,4,6,8,12,14,16,19-20,23-24,48,740,884,892,900,960
> > >
> > >
> > > Which says that led_blink_hdl() is called as a function pointer
> > > called
> > > "cmd_hdl" from rtw_cmd_thread().
> > >
> > > Hm... It says it can be called from either rtw_cmd_thread() function
> > > (the rtl8723bs or rtl8188eu version) which is not ideal. But also
> > > basically harmless so whatever...
> > >
> > > regards,
> > > dan carpenter
> >
> > Nice tool, thanks. I'll surely use it when it is needed to find out
> > which callers use a function pointer.
> >
> > However I cannot see how it can help in this context. That function
> > *does* something, even if I cannot understand why someone needs a
> > function to test the initialization of a pointer. Furthermore it is
> > actually called by rtw_cmd_thread() (as you found out by using smatch)
> > that expect one of the two possible values that led_blink_hdl()
> > returns.
> >
> > That said, what trick could I use for the purpose of getting rid of
> > that
> > function? At this point I'm not sure it could be made.
>
> If you look at how this is called:
>
> drivers/staging/rtl8723bs/core/rtw_cmd.c
> 449 memcpy(pcmdbuf, pcmd->parmbuf, pcmd->cmdsz);
> 450
> 451 if (pcmd->cmdcode < ARRAY_SIZE(wlancmds)) {
> 452 cmd_hdl =
> wlancmds[pcmd->cmdcode].h2cfuns; 453
> 454 if (cmd_hdl) {
> 455 ret = cmd_hdl(pcmd->padapter,
> pcmdbuf); ^^^^^^^
>
> 456 pcmd->res = ret;
> 457 }
> 458
> 459 pcmdpriv->cmd_seq++;
> 460 } else {
> 461 pcmd->res = H2C_PARAMETERS_ERROR;
> 462 }
> 463
> 464 cmd_hdl = NULL;
>
> The led_blink_hdl() function returns success if "pcmdbuf" is non-NULL
> and fail if it's NULL. "pcmdbuf" is never supposed to be NULL. (The
> "supposed" caveat is because there may be a race in rtw_sdio_if1_init()
> which briefly allows a NULL "pcmdbuf", but that is an unrelated bug).
>
> Anyway, there is no point to the led_blink_hdl() function. Likely
> they intended it to do something but never got around to implementing
> it. Just delete it.
>
> regards,
> dan carpenter
>
Fine. I'm about to submit a patch.
Is there any formal means to acknowledge (in the patch) your contribution
to the resolution of this problem?
Regards,
Fabio
Powered by blists - more mailing lists