Re: [PATCH] hid: intel-ish-hid: Fix uninitialized variable 'rv' in ish_fw_xfer_direct_dma

[Benjamin Tissoires]

On Oct 04 2024, SurajSonawane2415 wrote:
> Fix the uninitialized symbol 'rv' in the function ish_fw_xfer_direct_dma
> to resolve the following warning from the smatch tool:
> drivers/hid/intel-ish-hid/ishtp-fw-loader.c:714 ish_fw_xfer_direct_dma()
> error: uninitialized symbol 'rv'.
> Initialize 'rv' to 0 to prevent undefined behavior from uninitialized
> access.

Thanks for the patch!

FWIW, I tried to understand why this went unnoticced for so long: the
only case where rv might be used uninitialized is if fw->size == 0.

In that case, all that happens is that load_fw_from_host() tries to call
ish_fw_start() which will in turn overwrite the return value.

So I'm not sure if request_firmware() can return a firmware of size 0,
and if ish_fw_start() will be happy about that, but I would hope one of
the 2 would complain and not crash the kernel.

Anyway, I'll grab this one and adding Fixes and CC:stable as this might
catch an interesting bug, and fixing smatch complains is always good.

Cheers,
Benjamin


> 
> Signed-off-by: SurajSonawane2415 <surajsonawane0215@xxxxxxxxx>
> ---
>  drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> index e157863a8..b3c3cfcd9 100644
> --- a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> +++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c
> @@ -635,7 +635,7 @@ static int ish_fw_xfer_direct_dma(struct ishtp_cl_data *client_data,
>  				  const struct firmware *fw,
>  				  const struct shim_fw_info fw_info)
>  {
> -	int rv;
> +	int rv = 0;
>  	void *dma_buf;
>  	dma_addr_t dma_buf_phy;
>  	u32 fragment_offset, fragment_size, payload_max_size;
> -- 
> 2.34.1
>