From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0894BC54E94 for ; Thu, 26 Jan 2023 15:23:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232538AbjAZPXX (ORCPT ); Thu, 26 Jan 2023 10:23:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60924 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231751AbjAZPXH (ORCPT ); Thu, 26 Jan 2023 10:23:07 -0500 Received: from mx0a-00069f02.pphosted.com (mx0a-00069f02.pphosted.com [205.220.165.32]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6511330FD; Thu, 26 Jan 2023 07:22:53 -0800 (PST) Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 30QEj31W017888; Thu, 26 Jan 2023 15:22:07 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=from : to : cc : subject : date : message-id : mime-version : content-transfer-encoding; s=corp-2022-7-12; bh=SeU0YEj5vZ+FUQIuJdsMB00oQgNd1En7oY2e1SfIPy4=; b=sILhkJmb5uef0HCyoCOCvIRMgCd0xRJbUcaWcfnap+4agR96NGhnvT2I0kxDCm41I228 leKMROypY38kMW/7jc+diAbhaYPgfFtWcjitaWYCDpBpPTSGBisyAsK96PFoPViAaQTG fHO3Yogc94QC7c6isT1hjhQ9SnqH7IzN9tby0NxRJ9tzIrsjzy4WjMDPepwCrCOn6l3I VOgyY9MwzAm1VqL6X1JxbIYRCAnLKd4nFiY58/G5NUSY1h0g63BGtG3/r3G2f3qD/u7E 3+YTXVrFOSpV3Q1ZUswNPEsdWckIwHBKRdfvor/NwbRUPDeVizEaMPPK3iUST4thRlIY KA== Received: from phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta03.appoci.oracle.com [138.1.37.129]) by mx0b-00069f02.pphosted.com (PPS) with ESMTPS id 3n88ku2ebj-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 26 Jan 2023 15:22:07 +0000 Received: from pps.filterd (phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (8.17.1.5/8.17.1.5) with ESMTP id 30QFCa4m031876; Thu, 26 Jan 2023 15:22:06 GMT Received: from pps.reinject (localhost [127.0.0.1]) by phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTPS id 3n86g7yjcq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Thu, 26 Jan 2023 15:22:06 +0000 Received: from phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com [127.0.0.1]) by pps.reinject (8.17.1.5/8.17.1.5) with ESMTP id 30QFM5DD008869; Thu, 26 Jan 2023 15:22:05 GMT Received: from ca-dev112.us.oracle.com (ca-dev112.us.oracle.com [10.129.136.47]) by phxpaimrmta03.imrmtpd1.prodappphxaev1.oraclevcn.com (PPS) with ESMTP id 3n86g7yjc3-1; Thu, 26 Jan 2023 15:22:05 +0000 From: Harshit Mogalapalli Cc: harshit.m.mogalapalli@oracle.com, error27@gmail.com, Jonathan Cameron , Lars-Peter Clausen , Irina Tirdea , Vlad Dogaru , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] iio: accel: mma9551_core: Prevent uninitialized variable in mma9551_read_status_word() Date: Thu, 26 Jan 2023 07:21:46 -0800 Message-Id: <20230126152147.3585874-1-harshit.m.mogalapalli@oracle.com> X-Mailer: git-send-email 2.38.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.930,Hydra:6.0.562,FMLib:17.11.122.1 definitions=2023-01-26_07,2023-01-25_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 suspectscore=0 malwarescore=0 bulkscore=0 mlxscore=0 mlxlogscore=999 adultscore=0 spamscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2301260148 X-Proofpoint-GUID: 5lKeQ7FKJ8HsXbQC7Guz1oFsmjcBIsJr X-Proofpoint-ORIG-GUID: 5lKeQ7FKJ8HsXbQC7Guz1oFsmjcBIsJr To: unlisted-recipients:; (no To-header on input) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Smatch Warns: drivers/iio/accel/mma9551_core.c:357 mma9551_read_status_word() error: uninitialized symbol 'v'. When (offset >= 1 << 12) is true mma9551_transfer() will return -EINVAL without 'v' being initialized, so check for the error and return. Fixes: d5b97f5c7dfc ("iio: accel: mma9551: split driver to expose mma955x api") Signed-off-by: Harshit Mogalapalli --- This is detected using static analysis with smatch, and could probably be detected by syzkaller fuzzing in future. --- drivers/iio/accel/mma9551_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/iio/accel/mma9551_core.c b/drivers/iio/accel/mma9551_core.c index 75eee7f7303a..b898f865fb87 100644 --- a/drivers/iio/accel/mma9551_core.c +++ b/drivers/iio/accel/mma9551_core.c @@ -357,9 +357,12 @@ int mma9551_read_status_word(struct i2c_client *client, u8 app_id, ret = mma9551_transfer(client, app_id, MMA9551_CMD_READ_STATUS, reg, NULL, 0, (u8 *)&v, 2); + if (ret < 0) + return ret; + *val = be16_to_cpu(v); - return ret; + return 0; } EXPORT_SYMBOL_NS(mma9551_read_status_word, IIO_MMA9551); -- 2.38.1