| Message ID | 20241029021823.1978-1-rex.nie@jaguarmicro.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | usb: typec: qcom-pmic: fix uninitialized value hdr_len and txbuf_len | expand |
On Tue, Oct 29, 2024 at 10:18:23AM +0800, Rex Nie wrote: > If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and > txbuf_len are uninitialized. It makes no sense to print message header > and payload. It is also not safe to print uninitialized length of ram. > > Signed-off-by: Rex Nie <rex.nie@jaguarmicro.com> What commit id does this fix? thanks, greg k-h
> -----邮件原件----- > 发件人: Greg KH <gregkh@linuxfoundation.org> > 发送时间: 2024年10月29日 10:31 > 收件人: Rex Nie <rex.nie@jaguarmicro.com> > 抄送: bryan.odonoghue@linaro.org; heikki.krogerus@linux.intel.com; > linux-arm-msm@vger.kernel.org; linux-usb@vger.kernel.org; > linux-kernel@vger.kernel.org; Angus Chen <angus.chen@jaguarmicro.com> > 主题: Re: [PATCH] usb: typec: qcom-pmic: fix uninitialized value hdr_len and > txbuf_len > > External Mail: This email originated from OUTSIDE of the organization! > Do not click links, open attachments or provide ANY information unless you > recognize the sender and know the content is safe. > > > On Tue, Oct 29, 2024 at 10:18:23AM +0800, Rex Nie wrote: > > If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and > > txbuf_len are uninitialized. It makes no sense to print message header > > and payload. It is also not safe to print uninitialized length of ram. > > > > Signed-off-by: Rex Nie <rex.nie@jaguarmicro.com> > > What commit id does this fix? HI greg k-h, This patch fix the commit id: a4422ff221429c600c3dc5d0394fb3738b89d040, authored by Bryan O'Donoghue <bryan.odonoghue@linaro.org>. Thanks Rex > > thanks, > > greg k-h
On Tue, Oct 29, 2024 at 10:18:23AM GMT, Rex Nie wrote: > If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and > txbuf_len are uninitialized. It makes no sense to print message header > and payload. It is also not safe to print uninitialized length of ram. > > Signed-off-by: Rex Nie <rex.nie@jaguarmicro.com> > --- > drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c > index 5b7f52b74a40..53c2180a773a 100644 > --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c > +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c > @@ -221,7 +221,7 @@ qcom_pmic_typec_pdphy_pd_transmit_payload(struct pmic_typec_pdphy *pmic_typec_pd > unsigned int negotiated_rev) > { > struct device *dev = pmic_typec_pdphy->dev; > - unsigned int val, hdr_len, txbuf_len, txsize_len; > + unsigned int val, hdr_len = 0, txbuf_len = 0, txsize_len; This stops us from printing uninitialized values, but the error print is now containing misleading/false data instead. As far as I can tell, the assignment of these three variables depend only on the "msg" argument passed to the function, not on the operations leading up to their assignment. So how about just moving the 3 assignments up to the top of the function instead? Regards, Bjorn > unsigned long flags; > int ret; > > -- > 2.17.1 > >
On 29/10/2024 15:28, Bjorn Andersson wrote: >> + unsigned int val, hdr_len = 0, txbuf_len = 0, txsize_len; > This stops us from printing uninitialized values, but the error print is > now containing misleading/false data instead. Yes, the point of the error printout is to also give an indication of what data didn't transmit hdr_len = sizeof(msg->header); txbuf_len = pd_header_cnt_le(msg->header) * 4; The default values of the header should probably just be latched @ the top of this routine. We assume *msg contains valid data so instead of init to zero we should init as above. Please do that for your V2 including Fixes: a4422ff22142 (" usb: typec: qcom: Add Qualcomm PMIC Type-C driver") --- bod
diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c index 5b7f52b74a40..53c2180a773a 100644 --- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c @@ -221,7 +221,7 @@ qcom_pmic_typec_pdphy_pd_transmit_payload(struct pmic_typec_pdphy *pmic_typec_pd unsigned int negotiated_rev) { struct device *dev = pmic_typec_pdphy->dev; - unsigned int val, hdr_len, txbuf_len, txsize_len; + unsigned int val, hdr_len = 0, txbuf_len = 0, txsize_len; unsigned long flags; int ret;
If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and txbuf_len are uninitialized. It makes no sense to print message header and payload. It is also not safe to print uninitialized length of ram. Signed-off-by: Rex Nie <rex.nie@jaguarmicro.com> --- drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_pdphy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)