Re: [PATCH] [media] dib0700: Fix uninitialized protocol for NEC repeat codes

From: Sean Young
Date: Thu Oct 13 2016 - 17:24:40 EST


On Thu, Oct 13, 2016 at 03:51:39PM +0200, Geert Uytterhoeven wrote:
> drivers/media/usb/dvb-usb/dib0700_core.c: In function âdib0700_rc_urb_completionâ:
> drivers/media/usb/dvb-usb/dib0700_core.c:679: warning: âprotocolâ may be used uninitialized in this function
>
> When receiving an NEC repeat code, protocol is indeed not initialized.
> Set it to RC_TYPE_NECX to fix this.
>
> Fixes: 2ceeca0499d74521 ("[media] rc: split nec protocol into its three variants")
> Signed-off-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
> ---
> Is RC_TYPE_NECX correct, or should it be RC_TYPE_NEC?
> I used RC_TYPE_NECX based on the checks for {,not_}data and
> {,not_}system for the other cases.

It should be the protocol that the last scancode was received with. This
code path is very broken; it calls:

rc_keydown(d->rc_dev, protocol, keycode, toggle);

But keycode in this codepath is never set. Luckily keycode is declared as:

u32 uninitialized_var(keycode);

I've got another patch for this which I'll send as a reply to this.


Sean


> ---
> drivers/media/usb/dvb-usb/dib0700_core.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
> index f3196658fb700706..5878ae4d20ad27ed 100644
> --- a/drivers/media/usb/dvb-usb/dib0700_core.c
> +++ b/drivers/media/usb/dvb-usb/dib0700_core.c
> @@ -718,6 +718,7 @@ static void dib0700_rc_urb_completion(struct urb *purb)
> poll_reply->nec.data == 0x00 &&
> poll_reply->nec.not_data == 0xff) {
> poll_reply->data_state = 2;
> + protocol = RC_TYPE_NECX;
> break;
> }
>
> --
> 1.9.1
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at http://vger.kernel.org/majordomo-info.html