linux-kernel - Re: [PATCH] net: b44: uninitialized variable in multiple places in b44.c

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z2O+Q5Qp1R5KdMbg@mev-dev.igk.intel.com>
Date: Thu, 19 Dec 2024 07:33:39 +0100
From: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
To: Roshan Khatri <topofeverest8848@...il.com>
Cc: Michael Chan <michael.chan@...adcom.com>,
	Andrew Lunn <andrew+netdev@...n.ch>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] net: b44: uninitialized variable in multiple places in
 b44.c

On Thu, Dec 19, 2024 at 04:34:10AM +0000, Roshan Khatri wrote:
> smatch reported uninitialized variable in multiples places in b44.c.
> This patch fixes the uniinitialized variable errors in multiple places
> reported by smatch.
> 

You need fixes tag with the commit that introduced the issue when
targetting net. Like here for example [1]

[1] https://lore.kernel.org/netdev/CANn89i+yvyPMU1SE=p3Mm1S=UexsXSa4gzH3heUg17sa+iFK9w@mail.gmail.com/T/#t

> Signed-off-by: Roshan Khatri <topofeverest8848@...il.com>
> ---
>  drivers/net/ethernet/broadcom/b44.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
> index e5809ad5eb82..9a466c5c4b6c 100644
> --- a/drivers/net/ethernet/broadcom/b44.c
> +++ b/drivers/net/ethernet/broadcom/b44.c
> @@ -314,7 +314,7 @@ static int b44_mdio_write_phylib(struct mii_bus *bus, int phy_id, int location,
>  
>  static int b44_phy_reset(struct b44 *bp)
>  {
> -	u32 val;
> +	u32 val = 0;
>  	int err;
>  
>  	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
> @@ -414,7 +414,7 @@ static inline void b44_wap54g10_workaround(struct b44 *bp)
>  
>  static int b44_setup_phy(struct b44 *bp)
>  {
> -	u32 val;
> +	u32 val = 0;
>  	int err;
>  
>  	b44_wap54g10_workaround(bp);
> @@ -512,7 +512,7 @@ static void b44_link_report(struct b44 *bp)
>  
>  static void b44_check_phy(struct b44 *bp)
>  {
> -	u32 bmsr, aux;
> +	u32 bmsr = 0, aux = 0;
>  
>  	if (bp->flags & B44_FLAG_EXTERNAL_PHY) {
>  		bp->flags |= B44_FLAG_100_BASE_T;
> @@ -544,7 +544,7 @@ static void b44_check_phy(struct b44 *bp)
>  		if (!netif_carrier_ok(bp->dev) &&
>  		    (bmsr & BMSR_LSTATUS)) {
>  			u32 val = br32(bp, B44_TX_CTRL);
> -			u32 local_adv, remote_adv;
> +			u32 local_adv = 0, remote_adv = 0;
This two are real problems, because if the flag isn't clear, or first
read fails the variables won't be initialized when used.

>  
>  			if (bp->flags & B44_FLAG_FULL_DUPLEX)
>  				val |= TX_CTRL_DUPLEX;
> @@ -1786,7 +1786,7 @@ static void b44_get_drvinfo (struct net_device *dev, struct ethtool_drvinfo *inf
>  static int b44_nway_reset(struct net_device *dev)
>  {
>  	struct b44 *bp = netdev_priv(dev);
> -	u32 bmcr;
> +	u32 bmcr = 0;

The rest doesn't look like unitialized, you passing a pointer and
filling it with a value. Can't see the branch when the value is left
without filling, but maybe I don't see something obvious.

BTW, you have many "incorrect type in assignment" in cnic.c file.

Thanks
>  	int r;
>  
>  	spin_lock_irq(&bp->lock);
> -- 
> 2.34.1