2021-01-11 22:15:38

by Tom Rix

Subject: [PATCH] USB: serial: mos7720: improve handling of a kmalloc failure in read_mos_reg()

From: Tom Rix <[email protected]>

clang static analysis reports this problem

mos7720.c:352:2: warning: Undefined or garbage value returned to caller
return d;
^~~~~~~~

In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is
only set after the alloc block.

buf = kmalloc(1, GFP_KERNEL);
if (!buf)
return -ENOMEM;

Although the problem is reported in parport_most7715_read_data(),
none of the callee's of read_mos_reg() check the return status.

So move the clearing of data to before the malloc.

Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling")
Signed-off-by: Tom Rix <[email protected]>
---
drivers/usb/serial/mos7720.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 41ee2984a0df..23e8162c768b 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -214,6 +214,7 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
u8 *buf;
int status;

+ *data = 0;
buf = kmalloc(1, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -227,7 +228,6 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
"mos7720: usb_control_msg() failed: %d\n", status);
if (status >= 0)
status = -EIO;
- *data = 0;
}

kfree(buf);
--
2.27.0

2021-01-12 09:55:30

by Nathan Chancellor

Subject: Re: [PATCH] USB: serial: mos7720: improve handling of a kmalloc failure in read_mos_reg()

On Mon, Jan 11, 2021 at 02:09:04PM -0800, [email protected] wrote:
> From: Tom Rix <[email protected]>
>
> clang static analysis reports this problem
>
> mos7720.c:352:2: warning: Undefined or garbage value returned to caller
> return d;
> ^~~~~~~~
>
> In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is
> only set after the alloc block.
>
> buf = kmalloc(1, GFP_KERNEL);
> if (!buf)
> return -ENOMEM;
>
> Although the problem is reported in parport_most7715_read_data(),
> none of the callee's of read_mos_reg() check the return status.
>
> So move the clearing of data to before the malloc.
>
> Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling")
> Signed-off-by: Tom Rix <[email protected]>

Reviewed-by: Nathan Chancellor <[email protected]>

> ---
> drivers/usb/serial/mos7720.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
> index 41ee2984a0df..23e8162c768b 100644
> --- a/drivers/usb/serial/mos7720.c
> +++ b/drivers/usb/serial/mos7720.c
> @@ -214,6 +214,7 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
> u8 *buf;
> int status;
>
> + *data = 0;
> buf = kmalloc(1, GFP_KERNEL);
> if (!buf)
> return -ENOMEM;
> @@ -227,7 +228,6 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
> "mos7720: usb_control_msg() failed: %d\n", status);
> if (status >= 0)
> status = -EIO;
> - *data = 0;
> }
>
> kfree(buf);
> --
> 2.27.0
>

2021-01-12 12:03:15

by Johan Hovold

Subject: Re: [PATCH] USB: serial: mos7720: improve handling of a kmalloc failure in read_mos_reg()

On Mon, Jan 11, 2021 at 02:09:04PM -0800, [email protected] wrote:
> From: Tom Rix <[email protected]>
>
> clang static analysis reports this problem
>
> mos7720.c:352:2: warning: Undefined or garbage value returned to caller
> return d;
> ^~~~~~~~
>
> In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is
> only set after the alloc block.
>
> buf = kmalloc(1, GFP_KERNEL);
> if (!buf)
> return -ENOMEM;
>
> Although the problem is reported in parport_most7715_read_data(),
> none of the callee's of read_mos_reg() check the return status.
>
> So move the clearing of data to before the malloc.
>
> Fixes: 0d130367abf5 ("USB: serial: mos7720: fix control-message error handling")
> Signed-off-by: Tom Rix <[email protected]>
> ---
> drivers/usb/serial/mos7720.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
> index 41ee2984a0df..23e8162c768b 100644
> --- a/drivers/usb/serial/mos7720.c
> +++ b/drivers/usb/serial/mos7720.c
> @@ -214,6 +214,7 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
> u8 *buf;
> int status;
>
> + *data = 0;
> buf = kmalloc(1, GFP_KERNEL);
> if (!buf)
> return -ENOMEM;

I added a clearing of the buffer to this error path instead to avoid the
redundant assignment for every call due to something which will
basically never happen.

> @@ -227,7 +228,6 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
> "mos7720: usb_control_msg() failed: %d\n", status);
> if (status >= 0)
> status = -EIO;
> - *data = 0;
> }
>
> kfree(buf);

Johan