2018-10-10 10:40:12

by Dan Carpenter

Subject: [bug report] qtnfmac: cleanup and unify command error handling

Hello Sergey Matyukevich,

The patch c6ed298ffe09: "qtnfmac: cleanup and unify command error
handling" from Oct 5, 2018, leads to the following static checker
warning:

drivers/net/wireless/quantenna/qtnfmac/commands.c:132 qtnf_cmd_send_with_reply()
warn: variable dereferenced before check 'resp' (see line 117)

drivers/net/wireless/quantenna/qtnfmac/commands.c
112 ret = qtnf_trans_send_cmd_with_resp(bus, cmd_skb, &resp_skb);
113 if (ret)
114 goto out;
115
116 resp = (const struct qlink_resp *)resp_skb->data;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
117 ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id,
^^^^
Dereference

118 const_resp_size);
119 if (ret)
120 goto out;
121
122 /* Return length of variable part of response */
123 if (response_skb && var_resp_size)
124 *var_resp_size = le16_to_cpu(resp->mhdr.len) - const_resp_size;
125
126 out:
127 if (response_skb)
128 *response_skb = resp_skb;
129 else
130 consume_skb(resp_skb);
131
132 if (!ret && resp)
^^^^
This new check is not required.

133 return qtnf_cmd_resp_result_decode(le16_to_cpu(resp->result));
134
135 pr_warn("VIF%u.%u: cmd 0x%.4X failed: %d\n",
136 mac_id, vif_id, le16_to_cpu(cmd->cmd_id), ret);
137
138 return ret;
139 }

regards,
dan carpenter

2018-10-10 14:19:16

by Sergey Matyukevich

Subject: Re: [bug report] qtnfmac: cleanup and unify command error handling

Hello Dan,

> The patch c6ed298ffe09: "qtnfmac: cleanup and unify command error
> handling" from Oct 5, 2018, leads to the following static checker
> warning:
>
> drivers/net/wireless/quantenna/qtnfmac/commands.c:132 qtnf_cmd_send_with_reply()
> warn: variable dereferenced before check 'resp' (see line 117)

Thanks for the report! We will queue a fix into the next patch set.

Regards,
Sergey