cassini driver: Use of uninitialized memory

3 messages, 3 authors, 2011-08-26 · open the first message on its own page

cassini driver: Use of uninitialized memory

From: Thomas Jarosch <hidden>
Date: 2011-08-25 14:20:10

Hello,

the interrupt routine of the cassini driver
currently looks like this:

----------------------
static irqreturn_t cas_interruptN(int irq, void *dev_id)
{
	struct net_device *dev = dev_id;
	struct cas *cp = netdev_priv(dev);
	unsigned long flags;
	int ring;
	u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(ring));
...
----------------------

-> "ring" isn't initialized properly and gets used
in REG_PLUS_INTRN_STATUS. Some lines below there's this:

----------------------
	ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
----------------------

Should that line be moved before the readl() call
or should "ring" be initialized with zero?

Credit for spotting this goes to cppcheck.

Cheers,
Thomas

[PATCH] cassini: init before use in cas_interruptN.

From: Francois Romieu <romieu@fr.zoreil.com>
Date: 2011-08-25 15:20:49

Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Spotted-by: Thomas Jarosch [off-list ref]
---

 David, any opinion regarding the removal of the USE_NAPI #ifdef
 in this driver ?

 drivers/net/cassini.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 646c86b..fdb7a17 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -2452,14 +2452,13 @@ static irqreturn_t cas_interruptN(int irq, void *dev_id)
 	struct net_device *dev = dev_id;
 	struct cas *cp = netdev_priv(dev);
 	unsigned long flags;
-	int ring;
+	int ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
 	u32 status = readl(cp->regs + REG_PLUS_INTRN_STATUS(ring));
 
 	/* check for shared irq */
 	if (status == 0)
 		return IRQ_NONE;
 
-	ring = (irq == cp->pci_irq_INTC) ? 2 : 3;
 	spin_lock_irqsave(&cp->lock, flags);
 	if (status & INTR_RX_DONE_ALT) { /* handle rx separately */
 #ifdef USE_NAPI
-- 
1.7.4.4

Re: [PATCH] cassini: init before use in cas_interruptN.

From: David Miller <davem@davemloft.net>
Date: 2011-08-26 16:52:52

From: Francois Romieu <romieu@fr.zoreil.com>
Date: Thu, 25 Aug 2011 17:02:49 +0200
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
Spotted-by: Thomas Jarosch [off-list ref]
Applied, thanks!
 David, any opinion regarding the removal of the USE_NAPI #ifdef
 in this driver ?
No objections to removing it.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help