* [bug report] Input: add support for Azoteq IQS7222A/B/C
@ 2022-04-12 7:59 Dan Carpenter
2022-04-12 8:01 ` Dan Carpenter
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2022-04-12 7:59 UTC (permalink / raw)
To: jeff; +Cc: linux-input
Hello Jeff LaBundy,
The patch e505edaedcb9: "Input: add support for Azoteq IQS7222A/B/C"
from Apr 8, 2022, leads to the following Smatch static checker
warning:
drivers/input/misc/iqs7222.c:2166 iqs7222_parse_all()
error: NULL dereference inside function 'iqs7222_parse_props()'
drivers/input/misc/iqs7222.c
2150 static int iqs7222_parse_all(struct iqs7222_private *iqs7222)
2151 {
2152 const struct iqs7222_dev_desc *dev_desc = iqs7222->dev_desc;
2153 const struct iqs7222_reg_grp_desc *reg_grps = dev_desc->reg_grps;
2154 u16 *sys_setup = iqs7222->sys_setup;
2155 int error, i;
2156
2157 if (dev_desc->event_offset)
2158 sys_setup[dev_desc->event_offset] = IQS7222_EVENT_MASK_ATI;
2159
2160 for (i = 0; i < reg_grps[IQS7222_REG_GRP_CYCLE].num_row; i++) {
2161 error = iqs7222_parse_cycle(iqs7222, i);
2162 if (error)
2163 return error;
2164 }
2165
--> 2166 error = iqs7222_parse_props(iqs7222, NULL, 0, IQS7222_REG_GRP_GLBL,
^^^^
This NULL is dereferenced inside iqs7222_parse_props() so this will
crash.
2167 IQS7222_REG_KEY_NONE);
2168 if (error)
2169 return error;
2170
2171 for (i = 0; i < reg_grps[IQS7222_REG_GRP_GPIO].num_row; i++) {
2172 struct fwnode_handle *gpio_node = NULL;
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [bug report] Input: add support for Azoteq IQS7222A/B/C
2022-04-12 7:59 [bug report] Input: add support for Azoteq IQS7222A/B/C Dan Carpenter
@ 2022-04-12 8:01 ` Dan Carpenter
2022-04-12 9:22 ` Jeff LaBundy
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2022-04-12 8:01 UTC (permalink / raw)
To: jeff; +Cc: linux-input
There are a couple other warnings as well:
drivers/input/misc/iqs7222.c:2214 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
drivers/input/misc/iqs7222.c:2234 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
regards,
dan carpenter
On Tue, Apr 12, 2022 at 10:59:37AM +0300, Dan Carpenter wrote:
> Hello Jeff LaBundy,
>
> The patch e505edaedcb9: "Input: add support for Azoteq IQS7222A/B/C"
> from Apr 8, 2022, leads to the following Smatch static checker
> warning:
>
> drivers/input/misc/iqs7222.c:2166 iqs7222_parse_all()
> error: NULL dereference inside function 'iqs7222_parse_props()'
>
> drivers/input/misc/iqs7222.c
> 2150 static int iqs7222_parse_all(struct iqs7222_private *iqs7222)
> 2151 {
> 2152 const struct iqs7222_dev_desc *dev_desc = iqs7222->dev_desc;
> 2153 const struct iqs7222_reg_grp_desc *reg_grps = dev_desc->reg_grps;
> 2154 u16 *sys_setup = iqs7222->sys_setup;
> 2155 int error, i;
> 2156
> 2157 if (dev_desc->event_offset)
> 2158 sys_setup[dev_desc->event_offset] = IQS7222_EVENT_MASK_ATI;
> 2159
> 2160 for (i = 0; i < reg_grps[IQS7222_REG_GRP_CYCLE].num_row; i++) {
> 2161 error = iqs7222_parse_cycle(iqs7222, i);
> 2162 if (error)
> 2163 return error;
> 2164 }
> 2165
> --> 2166 error = iqs7222_parse_props(iqs7222, NULL, 0, IQS7222_REG_GRP_GLBL,
> ^^^^
> This NULL is dereferenced inside iqs7222_parse_props() so this will
> crash.
>
> 2167 IQS7222_REG_KEY_NONE);
> 2168 if (error)
> 2169 return error;
> 2170
> 2171 for (i = 0; i < reg_grps[IQS7222_REG_GRP_GPIO].num_row; i++) {
> 2172 struct fwnode_handle *gpio_node = NULL;
>
> regards,
> dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [bug report] Input: add support for Azoteq IQS7222A/B/C
2022-04-12 8:01 ` Dan Carpenter
@ 2022-04-12 9:22 ` Jeff LaBundy
2022-04-12 9:30 ` Dan Carpenter
0 siblings, 1 reply; 5+ messages in thread
From: Jeff LaBundy @ 2022-04-12 9:22 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-input
Hi Dan,
Thank you for reaching out.
On Tue, Apr 12, 2022 at 11:01:23AM +0300, Dan Carpenter wrote:
> There are a couple other warnings as well:
>
> drivers/input/misc/iqs7222.c:2214 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
> drivers/input/misc/iqs7222.c:2234 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
All three of these code paths are tested and do not lead to a crash; I
am suspicious that the warnings are false positives.
>
> regards,
> dan carpenter
>
> On Tue, Apr 12, 2022 at 10:59:37AM +0300, Dan Carpenter wrote:
> > Hello Jeff LaBundy,
> >
> > The patch e505edaedcb9: "Input: add support for Azoteq IQS7222A/B/C"
> > from Apr 8, 2022, leads to the following Smatch static checker
> > warning:
> >
> > drivers/input/misc/iqs7222.c:2166 iqs7222_parse_all()
> > error: NULL dereference inside function 'iqs7222_parse_props()'
> >
> > drivers/input/misc/iqs7222.c
> > 2150 static int iqs7222_parse_all(struct iqs7222_private *iqs7222)
> > 2151 {
> > 2152 const struct iqs7222_dev_desc *dev_desc = iqs7222->dev_desc;
> > 2153 const struct iqs7222_reg_grp_desc *reg_grps = dev_desc->reg_grps;
> > 2154 u16 *sys_setup = iqs7222->sys_setup;
> > 2155 int error, i;
> > 2156
> > 2157 if (dev_desc->event_offset)
> > 2158 sys_setup[dev_desc->event_offset] = IQS7222_EVENT_MASK_ATI;
> > 2159
> > 2160 for (i = 0; i < reg_grps[IQS7222_REG_GRP_CYCLE].num_row; i++) {
> > 2161 error = iqs7222_parse_cycle(iqs7222, i);
> > 2162 if (error)
> > 2163 return error;
> > 2164 }
> > 2165
> > --> 2166 error = iqs7222_parse_props(iqs7222, NULL, 0, IQS7222_REG_GRP_GLBL,
> > ^^^^
> > This NULL is dereferenced inside iqs7222_parse_props() so this will
> > crash.
By design, all calls to iqs7222_parse_props() with **child_node equal
to NULL are accompanied by a value of reg_grp that prevents the pointer
from being dereferenced.
For these specific cases, the pointer is reassigned by way of a switch
block at line 1542 before being dereferenced by fwnode_property_*().
> >
> > 2167 IQS7222_REG_KEY_NONE);
> > 2168 if (error)
> > 2169 return error;
> > 2170
> > 2171 for (i = 0; i < reg_grps[IQS7222_REG_GRP_GPIO].num_row; i++) {
> > 2172 struct fwnode_handle *gpio_node = NULL;
> >
> > regards,
> > dan carpenter
Please let me know in case I have misunderstood or you feel that I can
make any improvements.
Kind regards,
Jeff LaBundy
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [bug report] Input: add support for Azoteq IQS7222A/B/C
2022-04-12 9:22 ` Jeff LaBundy
@ 2022-04-12 9:30 ` Dan Carpenter
2022-04-17 18:28 ` Jeff LaBundy
0 siblings, 1 reply; 5+ messages in thread
From: Dan Carpenter @ 2022-04-12 9:30 UTC (permalink / raw)
To: Jeff LaBundy; +Cc: linux-input
On Tue, Apr 12, 2022 at 04:22:51AM -0500, Jeff LaBundy wrote:
> Hi Dan,
>
> Thank you for reaching out.
>
> On Tue, Apr 12, 2022 at 11:01:23AM +0300, Dan Carpenter wrote:
> > There are a couple other warnings as well:
> >
> > drivers/input/misc/iqs7222.c:2214 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
> > drivers/input/misc/iqs7222.c:2234 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
>
> All three of these code paths are tested and do not lead to a crash; I
> am suspicious that the warnings are false positives.
>
Are we looking at the same code. I am looking at linux-next. To me it
looks like the checker is obviously correct.
1530 static int iqs7222_parse_props(struct iqs7222_private *iqs7222,
1531 struct fwnode_handle **child_node,
^^^^^^^^^^^^
child_node is NULL
1532 int child_index,
1533 enum iqs7222_reg_grp_id reg_grp,
1534 enum iqs7222_reg_key_id reg_key)
1535 {
1536 u16 *setup = iqs7222_setup(iqs7222, reg_grp, child_index);
1537 struct fwnode_handle *reg_grp_node = *child_node;
^
Boom. Dead. What have I missed?
1538 struct i2c_client *client = iqs7222->client;
1539 char reg_grp_name[16];
1540 int i;
1541
regards,
dan carpenter
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [bug report] Input: add support for Azoteq IQS7222A/B/C
2022-04-12 9:30 ` Dan Carpenter
@ 2022-04-17 18:28 ` Jeff LaBundy
0 siblings, 0 replies; 5+ messages in thread
From: Jeff LaBundy @ 2022-04-17 18:28 UTC (permalink / raw)
To: Dan Carpenter; +Cc: linux-input
Hi Dan,
On Tue, Apr 12, 2022 at 12:30:39PM +0300, Dan Carpenter wrote:
> On Tue, Apr 12, 2022 at 04:22:51AM -0500, Jeff LaBundy wrote:
> > Hi Dan,
> >
> > Thank you for reaching out.
> >
> > On Tue, Apr 12, 2022 at 11:01:23AM +0300, Dan Carpenter wrote:
> > > There are a couple other warnings as well:
> > >
> > > drivers/input/misc/iqs7222.c:2214 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
> > > drivers/input/misc/iqs7222.c:2234 iqs7222_parse_all() error: NULL dereference inside function 'iqs7222_parse_props()
> >
> > All three of these code paths are tested and do not lead to a crash; I
> > am suspicious that the warnings are false positives.
> >
>
> Are we looking at the same code. I am looking at linux-next. To me it
> looks like the checker is obviously correct.
Please accept my apology for the delayed response as well as the
confusion from my side. Not surprisingly, both you and the tool
are correct on all counts.
>
> 1530 static int iqs7222_parse_props(struct iqs7222_private *iqs7222,
> 1531 struct fwnode_handle **child_node,
> ^^^^^^^^^^^^
> child_node is NULL
>
> 1532 int child_index,
> 1533 enum iqs7222_reg_grp_id reg_grp,
> 1534 enum iqs7222_reg_key_id reg_key)
> 1535 {
> 1536 u16 *setup = iqs7222_setup(iqs7222, reg_grp, child_index);
> 1537 struct fwnode_handle *reg_grp_node = *child_node;
> ^
> Boom. Dead. What have I missed?
This line was left over from some early development, and I simply
missed it. The code is working on real hardware, so I imagine the
compiler has simply optimized this out in favor of the subsequent
reassignment.
>
> 1538 struct i2c_client *client = iqs7222->client;
> 1539 char reg_grp_name[16];
> 1540 int i;
> 1541
>
> regards,
> dan carpenter
This is an easy fix and I will send out a patch shortly. Thank you
for digging into this with me.
Kind regards,
Jeff LaBundy
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-04-17 18:29 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-04-12 7:59 [bug report] Input: add support for Azoteq IQS7222A/B/C Dan Carpenter
2022-04-12 8:01 ` Dan Carpenter
2022-04-12 9:22 ` Jeff LaBundy
2022-04-12 9:30 ` Dan Carpenter
2022-04-17 18:28 ` Jeff LaBundy
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.