linux-amlogic.lists.infradead.org archive mirror
 help / color / mirror / Atom feed
From: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
To: Yizhuo <yzhai003@ucr.edu>
Cc: csong@cs.ucr.edu, Lars-Peter Clausen <lars@metafoo.de>,
	Neil Armstrong <narmstrong@baylibre.com>,
	linux-iio@vger.kernel.org, Kevin Hilman <khilman@baylibre.com>,
	Nicholas Mc Guire <hofrat@osadl.org>,
	zhiyunq@cs.ucr.edu,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	linux-kernel@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org,
	Peter Meerwald-Stadler <pmeerw@pmeerw.net>,
	Hartmut Knaack <knaack.h@gmx.de>,
	linux-amlogic@lists.infradead.org,
	Thomas Gleixner <tglx@linutronix.de>,
	Jonathan Cameron <jic23@kernel.org>
Subject: Re: [PATCH] iio: adc: meson-saradc: Variables could be uninitalized if regmap_read() fails
Date: Mon, 30 Sep 2019 23:16:15 +0200	[thread overview]
Message-ID: <CAFBinCCewgHnvL+HRXR8MBOT4fdnC-nxDAw8E5rGf+NZDsbaJg@mail.gmail.com> (raw)
In-Reply-To: <20190929164848.13930-1-yzhai003@ucr.edu>

Hi Yizhuo,

thank you for this patch

On Sun, Sep 29, 2019 at 6:48 PM Yizhuo <yzhai003@ucr.edu> wrote:
>
> Several functions in this file are trying to use regmap_read() to
> initialize the specific variable, however, if regmap_read() fails,
> the variable could be uninitialized but used directly, which is
> potentially unsafe. The return value of regmap_read() should be
> checked and handled.
the meson_saradc driver is using a MMIO regmap so read failures are
unlikely (unless there's a bug in the code somewhere)
did you find these issues with some static code analysis tool or did
you experience a real world problem?

> Signed-off-by: Yizhuo <yzhai003@ucr.edu>
> ---
>  drivers/iio/adc/meson_saradc.c | 30 ++++++++++++++++++++++++------
>  1 file changed, 24 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
> index 7b28d045d271..4b6c2983ef39 100644
> --- a/drivers/iio/adc/meson_saradc.c
> +++ b/drivers/iio/adc/meson_saradc.c
> @@ -323,6 +323,7 @@ static int meson_sar_adc_wait_busy_clear(struct iio_dev *indio_dev)
>  {
>         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
>         int regval, timeout = 10000;
> +       int ret;
why not add "ret" to the variables in the line above?
so this could be shortened to (which is also consistent with the
coding style in meson_saradc):
  int ret, regval, timeout = 10000;

> @@ -506,7 +514,10 @@ static int meson_sar_adc_lock(struct iio_dev *indio_dev)
>                  */
>                 do {
>                         udelay(1);
> -                       regmap_read(priv->regmap, MESON_SAR_ADC_DELAY, &val);
> +                       ret = regmap_read(priv->regmap,
> +                                               MESON_SAR_ADC_DELAY, &val);
> +                       if (ret)
> +                               return ret;
this is a big problem because we're returning with &indio_dev->mlock held
see the "timeout < 0" block below

> @@ -771,7 +782,7 @@ static int meson_sar_adc_init(struct iio_dev *indio_dev)
>  {
>         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
>         int regval, i, ret;
> -
> +       int ret;
this removes an empty line between the variable declarations and the
first code (comment)
also "ret" is already defined in the line before
(I haven't compile-tested this myself yet but I'm surprised that this
doesn't give an error or at least a warning)

> @@ -1013,8 +1027,12 @@ static irqreturn_t meson_sar_adc_irq(int irq, void *data)
>         struct meson_sar_adc_priv *priv = iio_priv(indio_dev);
>         unsigned int cnt, threshold;
>         u32 regval;
> +       int ret;
> +
> +       ret = regmap_read(priv->regmap, MESON_SAR_ADC_REG0, &regval);
> +       if (ret)
> +               return ret;
this function doesn't return "int" but irqreturn_t
the only allowed values are: [0]


Martin


[0] https://elixir.bootlin.com/linux/v5.3/source/include/linux/irqreturn.h#L11

_______________________________________________
linux-amlogic mailing list
linux-amlogic@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-amlogic

  reply	other threads:[~2019-09-30 21:17 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-29 16:48 [PATCH] iio: adc: meson-saradc: Variables could be uninitalized if regmap_read() fails Yizhuo
2019-09-30 21:16 ` Martin Blumenstingl [this message]
  -- strict thread matches above, loose matches on Subject: below --
2019-09-28  0:46 Yizhuo
2019-09-28  6:47 ` Nicholas Mc Guire
2019-09-29 16:54   ` Yizhuo Zhai

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAFBinCCewgHnvL+HRXR8MBOT4fdnC-nxDAw8E5rGf+NZDsbaJg@mail.gmail.com \
    --to=martin.blumenstingl@googlemail.com \
    --cc=csong@cs.ucr.edu \
    --cc=gregkh@linuxfoundation.org \
    --cc=hofrat@osadl.org \
    --cc=jic23@kernel.org \
    --cc=khilman@baylibre.com \
    --cc=knaack.h@gmx.de \
    --cc=lars@metafoo.de \
    --cc=linux-amlogic@lists.infradead.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-iio@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=narmstrong@baylibre.com \
    --cc=pmeerw@pmeerw.net \
    --cc=tglx@linutronix.de \
    --cc=yzhai003@ucr.edu \
    --cc=zhiyunq@cs.ucr.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).