linux-kernel - Re: [PATCH] media: atomisp: fix the uninitialized use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <8b717a74-e863-87d9-d42e-ede344a9e036@xs4all.nl>
Date:   Fri, 18 Jun 2021 12:37:23 +0200
From:   Hans Verkuil <hverkuil@...all.nl>
To:     Yizhuo Zhai <yzhai003@....edu>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        akari.ailus@...ux.intel.com,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        juant.aldea@...il.com, linux-media@...r.kernel.org,
        linux-staging@...ts.linux.dev, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] media: atomisp: fix the uninitialized use

On 15/06/2021 20:45, Yizhuo Zhai wrote:
> Inside function mt9m114_detect(), variable "retvalue" could
> be uninitialized if mt9m114_read_reg() returns error, however, it
> is used in the later if statement, which is potentially unsafe.
> 
> Signed-off-by: Yizhuo <yzhai003@....edu>
> ---
>  drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> index f5de81132177..8ddddb18ffbb 100644
> --- a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> +++ b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> @@ -1534,12 +1534,15 @@ static int mt9m114_detect(struct
> mt9m114_device *dev, struct i2c_client *client)
>  {
>         struct i2c_adapter *adapter = client->adapter;
>         u32 retvalue;
> +       int ret;

Hmm, 'ret' and 'retvalue'. That's a bit confusing. Just rename 'retvalue'
to 'model', then it makes more sense.

> 
>         if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
>                 dev_err(&client->dev, "%s: i2c error", __func__);
>                 return -ENODEV;
>         }
> -       mt9m114_read_reg(client, MISENSOR_16BIT, (u32)MT9M114_PID, &retvalue);
> +       ret = mt9m114_read_reg(client, MISENSOR_16BIT,
> (u32)MT9M114_PID, &retvalue);
> +       if (ret)
> +               return ret;
>         dev->real_model_id = retvalue;
> 
>         if (retvalue != MT9M114_MOD_ID) {
> 

This patch got mangled by your mail client: long lines were wrapped around.

Regards,

	Hans