mirror of
https://github.com/torvalds/linux
synced 2024-10-03 18:00:50 +00:00
6a6516c024
When usb_stor_bulk_transfer_sglist() returns with USB_STOR_XFER_ERROR, it returns without writing to its parameter *act_len. Further, the two callers of usb_stor_bulk_transfer_sglist(): usb_stor_bulk_srb() and usb_stor_bulk_transfer_sg(), use the passed variable partial without checking the return value. Hence, the uninitialized value of partial is then used in the further execution of those two functions. Clang-analyzer detects this potential control and data flow and warns: drivers/usb/storage/transport.c:469:40: warning: The right operand of '-' is a garbage value [clang-analyzer-core.UndefinedBinaryOperatorResult] scsi_set_resid(srb, scsi_bufflen(srb) - partial); ^ drivers/usb/storage/transport.c:495:15: warning: Assigned value is garbage or undefined [clang-analyzer-core.uninitialized.Assign] length_left -= partial; ^ When a transfer error occurs, the *act_len value is probably ignored by the higher layers. But it won't hurt to set it to a valid number, just in case. For the two early-return paths in usb_stor_bulk_transfer_sglist(), the amount of data transferred is 0. So if act_len is not NULL, set *act_len to 0 in those paths. That makes clang-analyzer happy. Proposal was discussed in this mail thread: https://lore.kernel.org/linux-usb/alpine.DEB.2.21.2011112146110.13119@felia/ Reviewed-by: Nathan Chancellor <natechancellor@gmail.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Link: https://lore.kernel.org/r/20201112191255.13372-1-lukas.bulwahn@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
alauda.c | ||
cypress_atacb.c | ||
datafab.c | ||
debug.c | ||
debug.h | ||
ene_ub6250.c | ||
freecom.c | ||
initializers.c | ||
initializers.h | ||
isd200.c | ||
jumpshot.c | ||
karma.c | ||
Kconfig | ||
Makefile | ||
onetouch.c | ||
option_ms.c | ||
option_ms.h | ||
protocol.c | ||
protocol.h | ||
realtek_cr.c | ||
scsiglue.c | ||
scsiglue.h | ||
sddr09.c | ||
sddr55.c | ||
shuttle_usbat.c | ||
sierra_ms.c | ||
sierra_ms.h | ||
transport.c | ||
transport.h | ||
uas-detect.h | ||
uas.c | ||
unusual_alauda.h | ||
unusual_cypress.h | ||
unusual_datafab.h | ||
unusual_devs.h | ||
unusual_ene_ub6250.h | ||
unusual_freecom.h | ||
unusual_isd200.h | ||
unusual_jumpshot.h | ||
unusual_karma.h | ||
unusual_onetouch.h | ||
unusual_realtek.h | ||
unusual_sddr09.h | ||
unusual_sddr55.h | ||
unusual_uas.h | ||
unusual_usbat.h | ||
usb.c | ||
usb.h | ||
usual-tables.c |