linux-kernel - Re: [PATCH] iwlwifi: fw: move memset before early return

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 5 Apr 2022 11:01:32 -0700
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     Tom Rix <trix@...hat.com>
Cc:     luciano.coelho@...el.com, kvalo@...nel.org, davem@...emloft.net,
        kuba@...nel.org, pabeni@...hat.com, nathan@...nel.org,
        johannes.berg@...el.com, mukesh.sisodiya@...el.com,
        mordechay.goodstein@...el.com, matti.gottlieb@...el.com,
        rotem.saado@...el.com, linux-wireless@...r.kernel.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        llvm@...ts.linux.dev
Subject: Re: [PATCH] iwlwifi: fw: move memset before early return

On Fri, Apr 1, 2022 at 4:38 PM Tom Rix <trix@...hat.com> wrote:
>
> Clang static analysis reports this representative issue
> dbg.c:1455:6: warning: Branch condition evaluates to
> a garbage value
>   if (!rxf_data.size)
>        ^~~~~~~~~~~~~~
>
> This check depends on iwl_ini_get_rxf_data() to clear
> rxf_data but the function can return early without
> doing the clear.  So move the memset before the early
> return.
>
> Fixes: cc9b6012d34b ("iwlwifi: yoyo: use hweight_long instead of bit manipulating")
> Signed-off-by: Tom Rix <trix@...hat.com>

Conditional initialization in a helper is a pretty dangerous pattern.
How about we move the memset to the two callers of
iwl_ini_get_rxf_data?

> ---
>  drivers/net/wireless/intel/iwlwifi/fw/dbg.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
> index abf49022edbe..666de922af61 100644
> --- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
> +++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c
> @@ -1388,13 +1388,13 @@ static void iwl_ini_get_rxf_data(struct iwl_fw_runtime *fwrt,
>         if (!data)
>                 return;
>
> +       memset(data, 0, sizeof(*data));
> +
>         /* make sure only one bit is set in only one fid */
>         if (WARN_ONCE(hweight_long(fid1) + hweight_long(fid2) != 1,
>                       "fid1=%x, fid2=%x\n", fid1, fid2))
>                 return;
>
> -       memset(data, 0, sizeof(*data));
> -
>         if (fid1) {
>                 fifo_idx = ffs(fid1) - 1;
>                 if (WARN_ONCE(fifo_idx >= MAX_NUM_LMAC, "fifo_idx=%d\n",
> --
> 2.27.0
>


-- 
Thanks,
~Nick Desaulniers