[bug report] of: Support parsing phandle argument lists through a nexus node

[bug report] of: Support parsing phandle argument lists through a nexus node

[Dan Carpenter]

Hello Stephen Boyd,

The patch bd6f2fd5a1d5: "of: Support parsing phandle argument lists
through a nexus node" from Jan 30, 2018, leads to the following
static checker warning:

	drivers/of/base.c:1592 of_parse_phandle_with_args_map()
	warn: loop overwrites return value 'ret'

drivers/of/base.c
  1590  
  1591          ret = -EINVAL;
                ^^^^^^^^^^^^^
This return is only used until part way through the first iteration.
For subsequent iterations, the code will return success in the case of
an error.

  1592          while (cur) {
  1593                  /* Get the <list>-map property */
  1594                  map = of_get_property(cur, map_name, &map_len);
  1595                  if (!map) {
  1596                          ret = 0;
  1597                          goto free;
  1598                  }
  1599                  map_len /= sizeof(u32);
  1600  
  1601                  /* Get the <list>-map-mask property (optional) */
  1602                  mask = of_get_property(cur, mask_name, NULL);
  1603                  if (!mask)
  1604                          mask = dummy_mask;
  1605                  /* Iterate through <list>-map property */
  1606                  match = 0;
  1607                  while (map_len > (list_size + 1) && !match) {
  1608                          /* Compare specifiers */
  1609                          match = 1;
  1610                          for (i = 0; i < list_size; i++, map_len--)
  1611                                  match &= !((match_array[i] ^ *map++) & mask[i]);
  1612  
  1613                          of_node_put(new);
  1614                          new = of_find_node_by_phandle(be32_to_cpup(map));
  1615                          map++;
  1616                          map_len--;
  1617  
  1618                          /* Check if not found */
  1619                          if (!new)
  1620                                  goto put;
  1621  
  1622                          if (!of_device_is_available(new))
  1623                                  match = 0;
  1624  
  1625                          ret = of_property_read_u32(new, cells_name, &new_size);
                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
"ret" set to zero here.

  1626                          if (ret)
  1627                                  goto put;
  1628  
  1629                          /* Check for malformed properties */
  1630                          if (WARN_ON(new_size > MAX_PHANDLE_ARGS))
  1631                                  goto put;
                                        ^^^^^^^^
Probably -EINVAL was intended here.

  1632                          if (map_len < new_size)
  1633                                  goto put;
  1634  
  1635                          /* Move forward by new node's #<list>-cells amount */
  1636                          map += new_size;
  1637                          map_len -= new_size;
  1638                  }
  1639                  if (!match)
  1640                          goto put;
  1641  
  1642                  /* Get the <list>-map-pass-thru property (optional) */
  1643                  pass = of_get_property(cur, pass_name, NULL);
  1644                  if (!pass)
  1645                          pass = dummy_pass;
  1646  
  1647                  /*
  1648                   * Successfully parsed a <list>-map translation; copy new
  1649                   * specifier into the out_args structure, keeping the
  1650                   * bits specified in <list>-map-pass-thru.
  1651                   */
  1652                  match_array = map - new_size;
  1653                  for (i = 0; i < new_size; i++) {
  1654                          __be32 val = *(map - new_size + i);
  1655  
  1656                          if (i < list_size) {
  1657                                  val &= ~pass[i];
  1658                                  val |= cpu_to_be32(out_args->args[i]) & pass[i];
  1659                          }
  1660  
  1661                          out_args->args[i] = be32_to_cpu(val);
  1662                  }
  1663                  out_args->args_count = list_size = new_size;
  1664                  /* Iterate again with new provider */
  1665                  out_args->np = new;
  1666                  of_node_put(cur);
  1667                  cur = new;
  1668          }
  1669  put:
  1670          of_node_put(cur);
  1671          of_node_put(new);
  1672  free:
  1673          kfree(mask_name);
  1674          kfree(map_name);
  1675          kfree(cells_name);
  1676          kfree(pass_name);
  1677  
  1678          return ret;
  1679  }

regards,
dan carpenter