| Message ID | 20170516110907.3545799-2-arnd@arndb.de |
|---|---|
| State | New |
| Headers | show |
| Series | HID: intel_ish-hid: various cleanups | expand |
On Tue, May 16, 2017 at 1:09 PM, Arnd Bergmann <arnd@arndb.de> wrote: > gcc points out an uninialized pointer dereference that could happen > if we ever get to recv_ishtp_cl_msg_dma() or recv_ishtp_cl_msg() > with an empty &dev->read_list: > > drivers/hid/intel-ish-hid/ishtp/client.c: In function 'recv_ishtp_cl_msg_dma': > drivers/hid/intel-ish-hid/ishtp/client.c:1049:3: error: 'cl' may be used uninitialized in this function [-Werror=maybe-uninitialized] > > The warning only appeared in very few randconfig builds, as the > spinlocks tend to prevent gcc from tracing the variables. I only > saw it in configurations that had neither SMP nor LOCKDEP enabled. > > I have not been able to figure out whether this case can happen in > practice, but it's better to be defensive here and handle the case > explicitly by returning from the function. > > Signed-off-by: Arnd Bergmann <arnd@arndb.de> Embarrassingly, this did not fix the warning in all cases after all, I ran into the same warning with the patch applied now. The other patches in the series are probably still good, but they might not apply without the first, so I'll have to come up with a better fix here and resend the series. Arnd -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/hid/intel-ish-hid/ishtp/client.c b/drivers/hid/intel-ish-hid/ishtp/client.c index aad61328f282..69c9d43612ec 100644 --- a/drivers/hid/intel-ish-hid/ishtp/client.c +++ b/drivers/hid/intel-ish-hid/ishtp/client.c @@ -829,6 +829,11 @@ void recv_ishtp_cl_msg(struct ishtp_device *dev, } spin_lock_irqsave(&dev->read_list_spinlock, dev_flags); + if (list_empty(&dev->read_list.list)) { + spin_unlock_irqrestore(&dev->read_list_spinlock, dev_flags); + goto eoi; + } + rb_count = -1; list_for_each_entry(rb, &dev->read_list.list, list) { ++rb_count; @@ -954,6 +959,11 @@ void recv_ishtp_cl_msg_dma(struct ishtp_device *dev, void *msg, unsigned long flags; spin_lock_irqsave(&dev->read_list_spinlock, dev_flags); + if (list_empty(&dev->read_list.list)) { + spin_unlock_irqrestore(&dev->read_list_spinlock, dev_flags); + goto eoi; + } + list_for_each_entry(rb, &dev->read_list.list, list) { cl = rb->cl; if (!cl || !(cl->host_client_id == hbm->host_client_id &&
gcc points out an uninialized pointer dereference that could happen if we ever get to recv_ishtp_cl_msg_dma() or recv_ishtp_cl_msg() with an empty &dev->read_list: drivers/hid/intel-ish-hid/ishtp/client.c: In function 'recv_ishtp_cl_msg_dma': drivers/hid/intel-ish-hid/ishtp/client.c:1049:3: error: 'cl' may be used uninitialized in this function [-Werror=maybe-uninitialized] The warning only appeared in very few randconfig builds, as the spinlocks tend to prevent gcc from tracing the variables. I only saw it in configurations that had neither SMP nor LOCKDEP enabled. I have not been able to figure out whether this case can happen in practice, but it's better to be defensive here and handle the case explicitly by returning from the function. Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- drivers/hid/intel-ish-hid/ishtp/client.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.9.0 -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html