LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Kalle Valo <kvalo@codeaurora.org>
To: Nathan Chancellor <natechancellor@gmail.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>,
	Amitkumar Karwar <amitkarwar@gmail.com>,
	Siva Rebbagondla <siva8118@gmail.com>,
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
	LKML <linux-kernel@vger.kernel.org>,
	clang-built-linux <clang-built-linux@googlegroups.com>
Subject: Re: [PATCH] rsi: Properly initialize data in rsi_sdio_ta_reset
Date: Thu, 23 May 2019 11:52:17 +0300	[thread overview]
Message-ID: <87r28po8n2.fsf@codeaurora.org> (raw)
In-Reply-To: <20190523015415.GA17819@archlinux-epyc> (Nathan Chancellor's message of "Wed, 22 May 2019 18:54:15 -0700")

Nathan Chancellor <natechancellor@gmail.com> writes:

> On Thu, May 02, 2019 at 08:17:18PM -0700, Nathan Chancellor wrote:
>> On Thu, May 02, 2019 at 11:18:01AM -0700, Nick Desaulniers wrote:
>> > On Thu, May 2, 2019 at 8:16 AM Nathan Chancellor
>> > <natechancellor@gmail.com> wrote:
>> > >
>> > > When building with -Wuninitialized, Clang warns:
>> > >
>> > > drivers/net/wireless/rsi/rsi_91x_sdio.c:940:43: warning: variable 'data'
>> > > is uninitialized when used here [-Wuninitialized]
>> > >         put_unaligned_le32(TA_HOLD_THREAD_VALUE, data);
>> > >                                                  ^~~~
>> > > drivers/net/wireless/rsi/rsi_91x_sdio.c:930:10: note: initialize the
>> > > variable 'data' to silence this warning
>> > >         u8 *data;
>> > >                 ^
>> > >                  = NULL
>> > > 1 warning generated.
>> > >
>> > > Using Clang's suggestion of initializing data to NULL wouldn't work out
>> > > because data will be dereferenced by put_unaligned_le32. Use kzalloc to
>> > > properly initialize data, which matches a couple of other places in this
>> > > driver.
>> > >
>> > > Fixes: e5a1ecc97e5f ("rsi: add firmware loading for 9116 device")
>> > > Link: https://github.com/ClangBuiltLinux/linux/issues/464
>> > > Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
>> > > ---
>> > >  drivers/net/wireless/rsi/rsi_91x_sdio.c | 21 ++++++++++++++-------
>> > >  1 file changed, 14 insertions(+), 7 deletions(-)
>> > >
>> > > diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
>> > > index f9c67ed473d1..b35728564c7b 100644
>> > > --- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
>> > > +++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
>> > > @@ -929,11 +929,15 @@ static int rsi_sdio_ta_reset(struct rsi_hw *adapter)
>> > >         u32 addr;
>> > >         u8 *data;
>> > >
>> > > +       data = kzalloc(sizeof(u32), GFP_KERNEL);
>> > 
>> > Something fishy is going on here.  We allocate 4 B but declare data as
>> > a u8* (pointer to individual bytes)?  In general, dynamically
>> > allocating that few bytes is a code smell; either you meant to just
>> > use the stack, or this memory's lifetime extends past the lifetime of
>> > this stackframe, at which point you probably just meant to stack
>> > allocate space in a higher parent frame and pass this preallocated
>> > memory down to the child frame to get filled in.
>> > 
>> > Reading through this code, I don't think that the memory is meant to
>> > outlive the stack frame.  Is there a reason why we can't just declare
>> > data as:
>> > 
>> > u8 data [4];
>> 
>> data was __le32 in rsi_reset_chip() before commit f700546682a6 ("rsi:
>> fix nommu_map_sg overflow kernel panic").
>> 
>> I wonder if this would be okay for this function:
>> 
>> -------------------------------------------------
>> 
>> diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
>> index f9c67ed473d1..0330c50ab99c 100644
>> --- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
>> +++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
>> @@ -927,7 +927,7 @@ static int rsi_sdio_ta_reset(struct rsi_hw *adapter)
>>  {
>>         int status;
>>         u32 addr;
>> -       u8 *data;
>> +       u8 data;
>>  
>>         status = rsi_sdio_master_access_msword(adapter, TA_BASE_ADDR);
>>         if (status < 0) {
>> @@ -937,7 +937,7 @@ static int rsi_sdio_ta_reset(struct rsi_hw *adapter)
>>         }
>>  
>>         rsi_dbg(INIT_ZONE, "%s: Bring TA out of reset\n", __func__);
>> -       put_unaligned_le32(TA_HOLD_THREAD_VALUE, data);
>> +       put_unaligned_le32(TA_HOLD_THREAD_VALUE, &data);
>>         addr = TA_HOLD_THREAD_REG | RSI_SD_REQUEST_MASTER;
>>         status = rsi_sdio_write_register_multiple(adapter, addr,
>>                                                   (u8 *)&data,
>> @@ -947,7 +947,7 @@ static int rsi_sdio_ta_reset(struct rsi_hw *adapter)
>>                 return status;
>>         }
>>  
>> -       put_unaligned_le32(TA_SOFT_RST_CLR, data);
>> +       put_unaligned_le32(TA_SOFT_RST_CLR, &data);
>>         addr = TA_SOFT_RESET_REG | RSI_SD_REQUEST_MASTER;
>>         status = rsi_sdio_write_register_multiple(adapter, addr,
>>                                                   (u8 *)&data,
>> @@ -957,7 +957,7 @@ static int rsi_sdio_ta_reset(struct rsi_hw *adapter)
>>                 return status;
>>         }
>>  
>> -       put_unaligned_le32(TA_PC_ZERO, data);
>> +       put_unaligned_le32(TA_PC_ZERO, &data);
>>         addr = TA_TH0_PC_REG | RSI_SD_REQUEST_MASTER;
>>         status = rsi_sdio_write_register_multiple(adapter, addr,
>>                                                   (u8 *)&data,
>> @@ -967,7 +967,7 @@ static int rsi_sdio_ta_reset(struct rsi_hw *adapter)
>>                 return -EINVAL;
>>         }
>>  
>> -       put_unaligned_le32(TA_RELEASE_THREAD_VALUE, data);
>> +       put_unaligned_le32(TA_RELEASE_THREAD_VALUE, &data);
>>         addr = TA_RELEASE_THREAD_REG | RSI_SD_REQUEST_MASTER;
>>         status = rsi_sdio_write_register_multiple(adapter, addr,
>>                                                   (u8 *)&data,
>> 
>> 
>> > 
>> > then use ARRAY_SIZE(data) or RSI_9116_REG_SIZE in rsi_reset_chip(),
>> > getting rid of the kzalloc/kfree?
>> > 
>> > (Sorry, I hate when a simple fixup becomes a "hey let's rewrite all
>> > this code" thus becoming "that guy.")
>> 
>> If we aren't actually improving the code, then why bother? :)
>> 
>> Thank you for the review!
>
> Did any of the maintainers have any comments on what the correct
> solution is here to resolve this warning? It is one of the few left
> before we can turn on -Wuninitialized for the whole kernel.

I don't have any strong opinion, but as the commit log says that
kzalloc() is also used in similar cases in the same driver I would happy
to take this patch as is.

-- 
Kalle Valo

  parent reply	other threads:[~2019-05-23  8:52 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-05-02 15:15 Nathan Chancellor
2019-05-02 18:18 ` Nick Desaulniers
2019-05-03  3:17   ` Nathan Chancellor
2019-05-23  1:54     ` Nathan Chancellor
2019-05-23  8:51       ` Arnd Bergmann
2019-05-23  8:56         ` Kalle Valo
2019-05-23  8:52       ` Kalle Valo [this message]
2019-05-03  4:38   ` Kalle Valo
2019-05-06 20:51     ` Nathan Chancellor
2019-05-23 15:30 ` [PATCH v2 5.2] " Nathan Chancellor
2019-05-28 11:33   ` Kalle Valo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87r28po8n2.fsf@codeaurora.org \
    --to=kvalo@codeaurora.org \
    --cc=amitkarwar@gmail.com \
    --cc=clang-built-linux@googlegroups.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=natechancellor@gmail.com \
    --cc=ndesaulniers@google.com \
    --cc=netdev@vger.kernel.org \
    --cc=siva8118@gmail.com \
    --subject='Re: [PATCH] rsi: Properly initialize data in rsi_sdio_ta_reset' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).