On 09/10/17 03:26, Geert Uytterhoeven wrote:
> With gcc 4.1.2:
>
> drivers/of/overlay.c: In function ‘dup_and_fixup_symbol_prop’:
> drivers/of/overlay.c:108: warning: ‘overlay_name_len’ may be used uninitialized in this function
> drivers/of/overlay.c:100: warning: ‘ovinfo’ may be used uninitialized in this function
>
> Indeed, if ov->count == 0, both variables are uninitialized, which may
> lead to a crash when dereferencing ovinfo later.
>
> Currently this is a false positive, as the sole creator of of_overlay
> structures (of_build_overlay_info(), introduced in commit
> 7518b5890d8ac366 ("of/overlay: Introduce DT overlay support") checks for
> this.
>
> To prevent future issues, add a check for a zero ov->count to
> dup_and_fixup_symbol_prop(). Note that this does not get rid of the
> actual compiler warning.
>
> Fixes: d1651b03c2df75db ("of: overlay: add overlay symbols to live device tree")
> Signed-off-by: Geert Uytterhoeven <geert@xxxxxxxxxxxxxx>
> ---
> drivers/of/overlay.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c
> index 8ecfee31ab6d3874..ebe19e0f8e4d1f4b 100644
> --- a/drivers/of/overlay.c
> +++ b/drivers/of/overlay.c
> @@ -108,7 +108,7 @@ static struct property *dup_and_fixup_symbol_prop(struct of_overlay *ov,
> int overlay_name_len;
> int target_path_len;
>
> - if (!prop->value)
> + if (!ov->count || !prop->value)
> return NULL;
> symbol_path = prop->value;
>
>
I did not see this patch due to an overzealous spam filter. I noticed it
when Rob replied with his applied email.
This check is not needed to prevent accessing overlay_name_len and ovinfo
when ov->count == 0. That is already prevented by:
if (k >= ov->count)
goto err_free;
because k will be zero and ov->count will be zero.
-Frank
--
To unsubscribe from this list: send the line "unsubscribe devicetree" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
