From: Daniel Starke <daniel.starke@xxxxxxxxxxx>
'size' may be used uninitialized in gsm_dlci_modem_output() if called with
an adaption that is neither 1 nor 2. The function is currently only called
by gsm_modem_upd_via_data() and only for adaption 2.
Properly handle every invalid case by returning -EINVAL to silence the
compiler warning and avoid future regressions.
Fixes: c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: kernel test robot <lkp@xxxxxxxxx>
Signed-off-by: Daniel Starke <daniel.starke@xxxxxxxxxxx>
---
drivers/tty/n_gsm.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 8652308c187f..a38b922bcbc1 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -932,18 +932,21 @@ static int gsm_dlci_modem_output(struct gsm_mux *gsm, struct gsm_dlci *dlci,
{
u8 *dp = NULL;
struct gsm_msg *msg;
- int size;
+ int size = 0;
/* for modem bits without break data */
- if (dlci->adaption == 1) {
- size = 0;
- } else if (dlci->adaption == 2) {
- size = 1;
+ switch (dlci->adaption) {
+ case 1: /* Unstructured */
+ break;
+ case 2: /* Unstructured with modem bits. */
+ size++;
if (brk > 0)
size++;
- } else {
+ break;
+ default:
pr_err("%s: unsupported adaption %d\n", __func__,
dlci->adaption);
+ return -EINVAL;
}
msg = gsm_data_alloc(gsm, dlci->addr, size, gsm->ftype);
--
2.25.1
