mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
6a6516c024
When usb_stor_bulk_transfer_sglist() returns with USB_STOR_XFER_ERROR, it
returns without writing to its parameter *act_len.
Further, the two callers of usb_stor_bulk_transfer_sglist():
usb_stor_bulk_srb() and
usb_stor_bulk_transfer_sg(),
use the passed variable partial without checking the return value. Hence,
the uninitialized value of partial is then used in the further execution
of those two functions.
Clang-analyzer detects this potential control and data flow and warns:
drivers/usb/storage/transport.c:469:40:
warning: The right operand of '-' is a garbage value
[clang-analyzer-core.UndefinedBinaryOperatorResult]
scsi_set_resid(srb, scsi_bufflen(srb) - partial);
^
drivers/usb/storage/transport.c:495:15:
warning: Assigned value is garbage or undefined
[clang-analyzer-core.uninitialized.Assign]
length_left -= partial;
^
When a transfer error occurs, the *act_len value is probably ignored by the
higher layers. But it won't hurt to set it to a valid number, just in case.
For the two early-return paths in usb_stor_bulk_transfer_sglist(), the
amount of data transferred is 0. So if act_len is not NULL, set *act_len
to 0 in those paths. That makes clang-analyzer happy.
Proposal was discussed in this mail thread:
https://lore.kernel.org/linux-usb/alpine.DEB.2.21.2011112146110.13119@felia/
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Link: https://lore.kernel.org/r/20201112191255.13372-1-lukas.bulwahn@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|---|---|---|
| .. | ||
| alauda.c | ||
| cypress_atacb.c | ||
| datafab.c | ||
| debug.c | ||
| debug.h | ||
| ene_ub6250.c | ||
| freecom.c | ||
| initializers.c | ||
| initializers.h | ||
| isd200.c | ||
| jumpshot.c | ||
| karma.c | ||
| Kconfig | ||
| Makefile | ||
| onetouch.c | ||
| option_ms.c | ||
| option_ms.h | ||
| protocol.c | ||
| protocol.h | ||
| realtek_cr.c | ||
| scsiglue.c | ||
| scsiglue.h | ||
| sddr09.c | ||
| sddr55.c | ||
| shuttle_usbat.c | ||
| sierra_ms.c | ||
| sierra_ms.h | ||
| transport.c | ||
| transport.h | ||
| uas-detect.h | ||
| uas.c | ||
| unusual_alauda.h | ||
| unusual_cypress.h | ||
| unusual_datafab.h | ||
| unusual_devs.h | ||
| unusual_ene_ub6250.h | ||
| unusual_freecom.h | ||
| unusual_isd200.h | ||
| unusual_jumpshot.h | ||
| unusual_karma.h | ||
| unusual_onetouch.h | ||
| unusual_realtek.h | ||
| unusual_sddr09.h | ||
| unusual_sddr55.h | ||
| unusual_uas.h | ||
| unusual_usbat.h | ||
| usb.c | ||
| usb.h | ||
| usual-tables.c | ||