linux-kernel - [broonie-sound:for-next 26/50] drivers/firmware/cirrus/cs_dsp.c:761 cs_dsp_coeff_write_ctrl() warn: variable dereferenced before check 'ctl' (see line 759)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <202111260147.g6ZphXY3-lkp@intel.com>
Date:   Mon, 29 Nov 2021 14:12:22 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Charles Keepax <ckeepax@...nsource.cirrus.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org, Mark Brown <broonie@...nel.org>
Subject: [broonie-sound:for-next 26/50] drivers/firmware/cirrus/cs_dsp.c:761
 cs_dsp_coeff_write_ctrl() warn: variable dereferenced before check 'ctl'
 (see line 759)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
head:   2b9c8d2b3c89708d53b6124dc49c212dc5341840
commit: 86c6080407740937ed2ba0ccd181e947f77e2154 [26/50] firmware: cs_dsp: Perform NULL check in cs_dsp_coeff_write/read_ctrl
config: openrisc-randconfig-m031-20211122 (https://download.01.org/0day-ci/archive/20211126/202111260147.g6ZphXY3-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 11.2.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

New smatch warnings:
drivers/firmware/cirrus/cs_dsp.c:761 cs_dsp_coeff_write_ctrl() warn: variable dereferenced before check 'ctl' (see line 759)
drivers/firmware/cirrus/cs_dsp.c:823 cs_dsp_coeff_read_ctrl() warn: variable dereferenced before check 'ctl' (see line 821)

vim +/ctl +761 drivers/firmware/cirrus/cs_dsp.c

f6bc909e7673c30 Simon Trimmer  2021-09-13  755  int cs_dsp_coeff_write_ctrl(struct cs_dsp_coeff_ctl *ctl, const void *buf, size_t len)
f6bc909e7673c30 Simon Trimmer  2021-09-13  756  {
f6bc909e7673c30 Simon Trimmer  2021-09-13  757  	int ret = 0;
f6bc909e7673c30 Simon Trimmer  2021-09-13  758  
5065cfabec21a4a Charles Keepax 2021-11-17 @759  	lockdep_assert_held(&ctl->dsp->pwr_lock);
                                                                             ^^^^^^^^^^^^^^^^^^
Dereference

5065cfabec21a4a Charles Keepax 2021-11-17  760  
86c608040774093 Charles Keepax 2021-11-17 @761  	if (!ctl)
                                                             ^^^
Checked too late

86c608040774093 Charles Keepax 2021-11-17  762  		return -ENOENT;
86c608040774093 Charles Keepax 2021-11-17  763  
f6bc909e7673c30 Simon Trimmer  2021-09-13  764  	if (ctl->flags & WMFW_CTL_FLAG_VOLATILE)
f6bc909e7673c30 Simon Trimmer  2021-09-13  765  		ret = -EPERM;
f6bc909e7673c30 Simon Trimmer  2021-09-13  766  	else if (buf != ctl->cache)
f6bc909e7673c30 Simon Trimmer  2021-09-13  767  		memcpy(ctl->cache, buf, len);
f6bc909e7673c30 Simon Trimmer  2021-09-13  768  
f6bc909e7673c30 Simon Trimmer  2021-09-13  769  	ctl->set = 1;
f6bc909e7673c30 Simon Trimmer  2021-09-13  770  	if (ctl->enabled && ctl->dsp->running)
f6bc909e7673c30 Simon Trimmer  2021-09-13  771  		ret = cs_dsp_coeff_write_ctrl_raw(ctl, buf, len);
f6bc909e7673c30 Simon Trimmer  2021-09-13  772  
f6bc909e7673c30 Simon Trimmer  2021-09-13  773  	return ret;
f6bc909e7673c30 Simon Trimmer  2021-09-13  774  }

[ snip ]

f6bc909e7673c30 Simon Trimmer  2021-09-13  817  int cs_dsp_coeff_read_ctrl(struct cs_dsp_coeff_ctl *ctl, void *buf, size_t len)
f6bc909e7673c30 Simon Trimmer  2021-09-13  818  {
f6bc909e7673c30 Simon Trimmer  2021-09-13  819  	int ret = 0;
f6bc909e7673c30 Simon Trimmer  2021-09-13  820  
5065cfabec21a4a Charles Keepax 2021-11-17 @821  	lockdep_assert_held(&ctl->dsp->pwr_lock);
                                                                            ^^^^^^^^^^^^^^^^^^^

5065cfabec21a4a Charles Keepax 2021-11-17  822  
86c608040774093 Charles Keepax 2021-11-17 @823  	if (!ctl)
                                                            ^^^^

86c608040774093 Charles Keepax 2021-11-17  824  		return -ENOENT;
86c608040774093 Charles Keepax 2021-11-17  825  
f6bc909e7673c30 Simon Trimmer  2021-09-13  826  	if (ctl->flags & WMFW_CTL_FLAG_VOLATILE) {
f6bc909e7673c30 Simon Trimmer  2021-09-13  827  		if (ctl->enabled && ctl->dsp->running)
f6bc909e7673c30 Simon Trimmer  2021-09-13  828  			return cs_dsp_coeff_read_ctrl_raw(ctl, buf, len);
f6bc909e7673c30 Simon Trimmer  2021-09-13  829  		else
f6bc909e7673c30 Simon Trimmer  2021-09-13  830  			return -EPERM;
f6bc909e7673c30 Simon Trimmer  2021-09-13  831  	} else {
f6bc909e7673c30 Simon Trimmer  2021-09-13  832  		if (!ctl->flags && ctl->enabled && ctl->dsp->running)
f6bc909e7673c30 Simon Trimmer  2021-09-13  833  			ret = cs_dsp_coeff_read_ctrl_raw(ctl, ctl->cache, ctl->len);
f6bc909e7673c30 Simon Trimmer  2021-09-13  834  
f6bc909e7673c30 Simon Trimmer  2021-09-13  835  		if (buf != ctl->cache)
f6bc909e7673c30 Simon Trimmer  2021-09-13  836  			memcpy(buf, ctl->cache, len);
f6bc909e7673c30 Simon Trimmer  2021-09-13  837  	}
f6bc909e7673c30 Simon Trimmer  2021-09-13  838  
f6bc909e7673c30 Simon Trimmer  2021-09-13  839  	return ret;
f6bc909e7673c30 Simon Trimmer  2021-09-13  840  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org