Re: [PATCH] of: overlay: Fix uninitialized vars in dup_and_fixup_symbol_prop()

[Frank Rowand]

On 09/19/17 13:16, Geert Uytterhoeven wrote:
> Hi Frank,
> 
> On Tue, Sep 19, 2017 at 8:27 PM, Frank Rowand <frowand.list@xxxxxxxxx> wrote:
>> On 09/10/17 03:26, Geert Uytterhoeven wrote:
>>> With gcc 4.1.2:
>>>
>>>     drivers/of/overlay.c: In function âdup_and_fixup_symbol_propâ:
>>>     drivers/of/overlay.c:108: warning: âoverlay_name_lenâ may be used uninitialized in this function
>>>     drivers/of/overlay.c:100: warning: âovinfoâ may be used uninitialized in this function
>>>
>>> Indeed, if ov->count == 0, both variables are uninitialized, which may
>>> lead to a crash when dereferencing ovinfo later.
>>>
>>> Currently this is a false positive, as the sole creator of of_overlay
>>> structures (of_build_overlay_info(), introduced in commit
>>> 7518b5890d8ac366 ("of/overlay: Introduce DT overlay support") checks for
>>> this.
>>>
>>> To prevent future issues, add a check for a zero ov->count to
>>> dup_and_fixup_symbol_prop().  Note that this does not get rid of the
>>> actual compiler warning.
>>>
>>> Fixes: d1651b03c2df75db ("of: overlay: add overlay symbols to live device tree")
>>> Signed-off-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
>>> ---
>>>  drivers/of/overlay.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
>>> index 8ecfee31ab6d3874..ebe19e0f8e4d1f4b 100644
>>> --- a/drivers/of/overlay.c
>>> +++ b/drivers/of/overlay.c
>>> @@ -108,7 +108,7 @@ static struct property *dup_and_fixup_symbol_prop(struct of_overlay *ov,
>>>       int overlay_name_len;
>>>       int target_path_len;
>>>
>>> -     if (!prop->value)
>>> +     if (!ov->count || !prop->value)
>>>               return NULL;
>>>       symbol_path = prop->value;
>>>
>>
>> I did not see this patch due to an overzealous spam filter.  I noticed it
>> when Rob replied with his applied email.
>>
>> This check is not needed to prevent accessing overlay_name_len and ovinfo
>> when ov->count == 0.  That is already prevented by:
>>
>>         if (k >= ov->count)
>>                 goto err_free;
>>
>> because k will be zero and ov->count will be zero.
> 
> Thank you, I stand corrected.

No problem.  It's not real obvious, you really need to stop and
ponder.