Skip to content

Commit 9a35bc2

Browse files
arndbgregkh
authored andcommitted
hostap: avoid uninitialized variable use in hfa384x_get_rid
commit 48dc5fb3ba53b20418de8514700f63d88c5de3a3 upstream. The driver reads a value from hfa384x_from_bap(), which may fail, and then assigns the value to a local variable. gcc detects that in in the failure case, the 'rlen' variable now contains uninitialized data: In file included from ../drivers/net/wireless/intersil/hostap/hostap_pci.c:220:0: drivers/net/wireless/intersil/hostap/hostap_hw.c: In function 'hfa384x_get_rid': drivers/net/wireless/intersil/hostap/hostap_hw.c:842:5: warning: 'rec' may be used uninitialized in this function [-Wmaybe-uninitialized] if (le16_to_cpu(rec.len) == 0) { This restructures the function as suggested by Russell King, to make it more readable and get more reliable error handling, by handling each failure mode using a goto. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 58f80cc commit 9a35bc2

1 file changed

Lines changed: 10 additions & 5 deletions

File tree

drivers/net/wireless/hostap/hostap_hw.c

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -836,25 +836,30 @@ static int hfa384x_get_rid(struct net_device *dev, u16 rid, void *buf, int len,
836836
spin_lock_bh(&local->baplock);
837837

838838
res = hfa384x_setup_bap(dev, BAP0, rid, 0);
839-
if (!res)
840-
res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec));
839+
if (res)
840+
goto unlock;
841+
842+
res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec));
843+
if (res)
844+
goto unlock;
841845

842846
if (le16_to_cpu(rec.len) == 0) {
843847
/* RID not available */
844848
res = -ENODATA;
849+
goto unlock;
845850
}
846851

847852
rlen = (le16_to_cpu(rec.len) - 1) * 2;
848-
if (!res && exact_len && rlen != len) {
853+
if (exact_len && rlen != len) {
849854
printk(KERN_DEBUG "%s: hfa384x_get_rid - RID len mismatch: "
850855
"rid=0x%04x, len=%d (expected %d)\n",
851856
dev->name, rid, rlen, len);
852857
res = -ENODATA;
853858
}
854859

855-
if (!res)
856-
res = hfa384x_from_bap(dev, BAP0, buf, len);
860+
res = hfa384x_from_bap(dev, BAP0, buf, len);
857861

862+
unlock:
858863
spin_unlock_bh(&local->baplock);
859864
mutex_unlock(&local->rid_bap_mtx);
860865

0 commit comments

Comments
 (0)