lkml.org 
[lkml]   [2017]   [Apr]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.18 33/47] hostap: avoid uninitialized variable use in hfa384x_get_rid
    Date
    3.18-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Arnd Bergmann <arnd@arndb.de>

    commit 48dc5fb3ba53b20418de8514700f63d88c5de3a3 upstream.

    The driver reads a value from hfa384x_from_bap(), which may fail,
    and then assigns the value to a local variable. gcc detects that
    in in the failure case, the 'rlen' variable now contains
    uninitialized data:

    In file included from ../drivers/net/wireless/intersil/hostap/hostap_pci.c:220:0:
    drivers/net/wireless/intersil/hostap/hostap_hw.c: In function 'hfa384x_get_rid':
    drivers/net/wireless/intersil/hostap/hostap_hw.c:842:5: warning: 'rec' may be used uninitialized in this function [-Wmaybe-uninitialized]
    if (le16_to_cpu(rec.len) == 0) {

    This restructures the function as suggested by Russell King, to
    make it more readable and get more reliable error handling, by
    handling each failure mode using a goto.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/wireless/hostap/hostap_hw.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    --- a/drivers/net/wireless/hostap/hostap_hw.c
    +++ b/drivers/net/wireless/hostap/hostap_hw.c
    @@ -836,25 +836,30 @@ static int hfa384x_get_rid(struct net_de
    spin_lock_bh(&local->baplock);

    res = hfa384x_setup_bap(dev, BAP0, rid, 0);
    - if (!res)
    - res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec));
    + if (res)
    + goto unlock;
    +
    + res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec));
    + if (res)
    + goto unlock;

    if (le16_to_cpu(rec.len) == 0) {
    /* RID not available */
    res = -ENODATA;
    + goto unlock;
    }

    rlen = (le16_to_cpu(rec.len) - 1) * 2;
    - if (!res && exact_len && rlen != len) {
    + if (exact_len && rlen != len) {
    printk(KERN_DEBUG "%s: hfa384x_get_rid - RID len mismatch: "
    "rid=0x%04x, len=%d (expected %d)\n",
    dev->name, rid, rlen, len);
    res = -ENODATA;
    }

    - if (!res)
    - res = hfa384x_from_bap(dev, BAP0, buf, len);
    + res = hfa384x_from_bap(dev, BAP0, buf, len);

    +unlock:
    spin_unlock_bh(&local->baplock);
    mutex_unlock(&local->rid_bap_mtx);


    \
     
     \ /
      Last update: 2017-04-28 10:42    [W:3.834 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site