linux-kernel - drivers/usb/cdns3/cdnsp-mem.c:1076 cdnsp_mem_cleanup() warn: variable dereferenced before check 'pdev->dcbaa' (see line 1058)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 28 Apr 2021 12:49:58 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Pawel Laszczak <pawell@...ence.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org, Peter Chen <peter.chen@....com>
Subject: drivers/usb/cdns3/cdnsp-mem.c:1076 cdnsp_mem_cleanup() warn:
 variable dereferenced before check 'pdev->dcbaa' (see line 1058)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   5bfc75d92efd494db37f5c4c173d3639d4772966
commit: 3d82904559f4f5a2622db1b21de3edf2eded7664 usb: cdnsp: cdns3 Add main part of Cadence USBSSP DRD Driver
config: ia64-randconfig-m031-20210423 (attached as .config)
compiler: ia64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

smatch warnings:
drivers/usb/cdns3/cdnsp-mem.c:1076 cdnsp_mem_cleanup() warn: variable dereferenced before check 'pdev->dcbaa' (see line 1058)

vim +1076 drivers/usb/cdns3/cdnsp-mem.c

3d82904559f4f5 Pawel Laszczak 2020-12-07  1054  void cdnsp_mem_cleanup(struct cdnsp_device *pdev)
3d82904559f4f5 Pawel Laszczak 2020-12-07  1055  {
3d82904559f4f5 Pawel Laszczak 2020-12-07  1056  	struct device *dev = pdev->dev;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1057  
3d82904559f4f5 Pawel Laszczak 2020-12-07 @1058  	cdnsp_free_priv_device(pdev);
                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Dereferences "pdev->dcbaa" without checking

3d82904559f4f5 Pawel Laszczak 2020-12-07  1059  	cdnsp_free_erst(pdev, &pdev->erst);
3d82904559f4f5 Pawel Laszczak 2020-12-07  1060  
3d82904559f4f5 Pawel Laszczak 2020-12-07  1061  	if (pdev->event_ring)
3d82904559f4f5 Pawel Laszczak 2020-12-07  1062  		cdnsp_ring_free(pdev, pdev->event_ring);
3d82904559f4f5 Pawel Laszczak 2020-12-07  1063  
3d82904559f4f5 Pawel Laszczak 2020-12-07  1064  	pdev->event_ring = NULL;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1065  
3d82904559f4f5 Pawel Laszczak 2020-12-07  1066  	if (pdev->cmd_ring)
3d82904559f4f5 Pawel Laszczak 2020-12-07  1067  		cdnsp_ring_free(pdev, pdev->cmd_ring);
3d82904559f4f5 Pawel Laszczak 2020-12-07  1068  
3d82904559f4f5 Pawel Laszczak 2020-12-07  1069  	pdev->cmd_ring = NULL;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1070  
3d82904559f4f5 Pawel Laszczak 2020-12-07  1071  	dma_pool_destroy(pdev->segment_pool);
3d82904559f4f5 Pawel Laszczak 2020-12-07  1072  	pdev->segment_pool = NULL;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1073  	dma_pool_destroy(pdev->device_pool);
3d82904559f4f5 Pawel Laszczak 2020-12-07  1074  	pdev->device_pool = NULL;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1075  
3d82904559f4f5 Pawel Laszczak 2020-12-07 @1076  	if (pdev->dcbaa)
                                                            ^^^^^^^^^^^
Too late

3d82904559f4f5 Pawel Laszczak 2020-12-07  1077  		dma_free_coherent(dev, sizeof(*pdev->dcbaa),
3d82904559f4f5 Pawel Laszczak 2020-12-07  1078  				  pdev->dcbaa, pdev->dcbaa->dma);
3d82904559f4f5 Pawel Laszczak 2020-12-07  1079  
3d82904559f4f5 Pawel Laszczak 2020-12-07  1080  	pdev->dcbaa = NULL;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1081  
3d82904559f4f5 Pawel Laszczak 2020-12-07  1082  	pdev->usb2_port.exist = 0;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1083  	pdev->usb3_port.exist = 0;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1084  	pdev->usb2_port.port_num = 0;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1085  	pdev->usb3_port.port_num = 0;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1086  	pdev->active_port = NULL;
3d82904559f4f5 Pawel Laszczak 2020-12-07  1087  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

Download attachment ".config.gz" of type "application/gzip" (24387 bytes)