Mailing List Archive: [PATCH] media: atomisp: fix the uninitialized use

Inside function mt9m114_detect(), variable "retvalue" could
be uninitialized if mt9m114_read_reg() returns error, however, it
is used in the later if statement, which is potentially unsafe.

Signed-off-by: Yizhuo <yzhai003@ucr.edu>
---
drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
index f5de81132177..8ddddb18ffbb 100644
--- a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
+++ b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
@@ -1534,12 +1534,15 @@ static int mt9m114_detect(struct
mt9m114_device *dev, struct i2c_client *client)
{
struct i2c_adapter *adapter = client->adapter;
u32 retvalue;
+ int ret;

if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
dev_err(&client->dev, "%s: i2c error", __func__);
return -ENODEV;
}
- mt9m114_read_reg(client, MISENSOR_16BIT, (u32)MT9M114_PID, &retvalue);
+ ret = mt9m114_read_reg(client, MISENSOR_16BIT,
(u32)MT9M114_PID, &retvalue);
+ if (ret)
+ return ret;
dev->real_model_id = retvalue;

if (retvalue != MT9M114_MOD_ID) {
--
2.17.1

On 15/06/2021 20:45, Yizhuo Zhai wrote:
> Inside function mt9m114_detect(), variable "retvalue" could
> be uninitialized if mt9m114_read_reg() returns error, however, it
> is used in the later if statement, which is potentially unsafe.
>
> Signed-off-by: Yizhuo <yzhai003@ucr.edu>
> ---
> drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> index f5de81132177..8ddddb18ffbb 100644
> --- a/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> +++ b/drivers/staging/media/atomisp/i2c/atomisp-mt9m114.c
> @@ -1534,12 +1534,15 @@ static int mt9m114_detect(struct
> mt9m114_device *dev, struct i2c_client *client)
> {
> struct i2c_adapter *adapter = client->adapter;
> u32 retvalue;
> + int ret;

Hmm, 'ret' and 'retvalue'. That's a bit confusing. Just rename 'retvalue'
to 'model', then it makes more sense.

>
> if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
> dev_err(&client->dev, "%s: i2c error", __func__);
> return -ENODEV;
> }
> - mt9m114_read_reg(client, MISENSOR_16BIT, (u32)MT9M114_PID, &retvalue);
> + ret = mt9m114_read_reg(client, MISENSOR_16BIT,
> (u32)MT9M114_PID, &retvalue);
> + if (ret)
> + return ret;
> dev->real_model_id = retvalue;
>
> if (retvalue != MT9M114_MOD_ID) {
>

This patch got mangled by your mail client: long lines were wrapped around.

Regards,

Hans