linux-kernel - Re: [PATCH] hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <gx5bubwp2vsei4o6aoahsj5nivlqdl6vdwricxkh6icupuq4nc@wboib5iyqsmj>
Date: Fri, 4 Oct 2024 10:32:35 +0200
From: Benjamin Tissoires <bentiss@...nel.org>
To: SurajSonawane2415 <surajsonawane0215@...il.com>
Cc: srinivas.pandruvada@...ux.intel.com, jikos@...nel.org, 
	linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] hid: intel-ish-hid: Fix uninitialized variable 'rv' in
 ish_fw_xfer_direct_dma

On Oct 04 2024, SurajSonawane2415 wrote:
> Fix the uninitialized symbol 'rv' in the function ish_fw_xfer_direct_dma
> to resolve the following warning from the smatch tool:
> drivers/hid/intel-ish-hid/ishtp-fw-loader.c:714 ish_fw_xfer_direct_dma()
> error: uninitialized symbol 'rv'.
> Initialize 'rv' to 0 to prevent undefined behavior from uninitialized
> access.

Thanks for the patch!

FWIW, I tried to understand why this went unnoticced for so long: the
only case where rv might be used uninitialized is if fw->size == 0.

In that case, all that happens is that load_fw_from_host() tries to call
ish_fw_start() which will in turn overwrite the return value.

So I'm not sure if request_firmware() can return a firmware of size 0,
and if ish_fw_start() will be happy about that, but I would hope one of
the 2 would complain and not crash the kernel.

Anyway, I'll grab this one and adding Fixes and CC:stable as this might
catch an interesting bug, and fixing smatch complains is always good.

Cheers,
Benjamin


> 
> Signed-off-by: SurajSonawane2415 <surajsonawane0215@...il.com>
> ---
>  drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> index e157863a8..b3c3cfcd9 100644
> --- a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> +++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> @@ -635,7 +635,7 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
>  				  const struct firmware *fw,
>  				  const struct shim_fw_info fw_info)
>  {
> -	int rv;
> +	int rv = 0;
>  	void *dma_buf;
>  	dma_addr_t dma_buf_phy;
>  	u32 fragment_offset, fragment_size, payload_max_size;
> -- 
> 2.34.1
>