From: Yao Zi <ziyao@disroot.org>
To: Andrew Goodbody <andrew.goodbody@linaro.org>,
Tom Rini <trini@konsulko.com>
Cc: u-boot@lists.denx.de
Subject: Re: [PATCH] boot: Ensure that ranges is not used uninitialised
Date: Fri, 27 Jun 2025 12:23:31 +0000 [thread overview]
Message-ID: <aF6NQ2zt5qKS0UsD@pie> (raw)
In-Reply-To: <20250627-boot_fdt_fix-v1-1-d2e0c4b13762@linaro.org>
On Fri, Jun 27, 2025 at 12:51:02PM +0100, Andrew Goodbody wrote:
> The local variable ranges may be used uninitialised if the function
> fdt_get_dma_range is called with node < 0. Ensure this does not
> happen by initialising ranges when declared.
It doesn't harm. When node < 0, parent is less than zero as well, and
the first while loop is skipped. The control flow just fails into the
error path where parent < 0 stays true.
Furthermore, it doesn't seem valid to call fdt_get_dma_range() with a
negative node parameter, does it?
> /**
> * fdt_get_dma_range() - get DMA ranges to perform bus/cpu translations
> *
> * @blob: pointer to device tree blob
> * @node_offset: node DT offset
> * @cpu: pointer to variable storing the range's cpu address
> * @bus: pointer to variable storing the range's bus address
> * @size: pointer to variable storing the range's size
> *
> * Get DMA ranges for a specifc node, this is useful to perform bus->cpu and
> * cpu->bus address translations
> *
> * Return: translated DMA address or OF_BAD_ADDR on error
> */
> int fdt_get_dma_range(const void *blob, int node_offset, phys_addr_t *cpu,
> dma_addr_t *bus, u64 *size);
Regards,
Yao Zi
> This issue was found with Smatch.
>
> Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
> ---
> boot/fdt_support.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/boot/fdt_support.c b/boot/fdt_support.c
> index 92f2f534ee0..4f63ce9a763 100644
> --- a/boot/fdt_support.c
> +++ b/boot/fdt_support.c
> @@ -1547,7 +1547,7 @@ int fdt_get_dma_range(const void *blob, int node, phys_addr_t *cpu,
> {
> bool found_dma_ranges = false;
> struct of_bus *bus_node;
> - const fdt32_t *ranges;
> + const fdt32_t *ranges = NULL;
> int na, ns, pna, pns;
> int parent = node;
> int ret = 0;
>
> ---
> base-commit: 359e3012921f2fc2d43f3c4e320a752173f82b82
> change-id: 20250627-boot_fdt_fix-e4e56d956c8a
>
> Best regards,
> --
> Andrew Goodbody <andrew.goodbody@linaro.org>
>
next prev parent reply other threads:[~2025-06-27 12:23 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-27 11:51 [PATCH] boot: Ensure that ranges is not used uninitialised Andrew Goodbody
2025-06-27 12:23 ` Yao Zi [this message]
2025-06-30 9:51 ` Andrew Goodbody
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aF6NQ2zt5qKS0UsD@pie \
--to=ziyao@disroot.org \
--cc=andrew.goodbody@linaro.org \
--cc=trini@konsulko.com \
--cc=u-boot@lists.denx.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.