From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alex Williamson Subject: Re: Coverity CID 714665: vfio_ext_cap_len() use of uninitialized variable Date: Thu, 03 Apr 2014 10:55:23 -0600 Message-ID: <1396544123.3215.8.camel@ul30vt.home> References: Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit Cc: "kvm@vger.kernel.org" , "linux-pci@vger.kernel.org" To: Bjorn Helgaas Return-path: In-Reply-To: Sender: linux-pci-owner@vger.kernel.org List-Id: kvm.vger.kernel.org On Thu, 2014-04-03 at 10:48 -0600, Bjorn Helgaas wrote: > On Thu, Apr 3, 2014 at 9:53 AM, Bjorn Helgaas wrote: > > Coverity complains that "byte" is used uninitialized in > > drivers/vfio/pci/vfio_pci_config.c in vfio_ext_cap_len(): > > > > 1139 sts = byte & PCI_TPH_CAP_ST_MASK; > > 1140 sts >>= PCI_TPH_CAP_ST_SHIFT; > > 1141 return PCI_TPH_BASE_SIZEOF + round_up(sts * 2, 4); > > > > This is CID 714665. > > I think "dword" was probably intended instead of "byte". Changing > that would also fix CID 715156: > > 1136 if ((dword & PCI_TPH_CAP_LOC_MASK) == PCI_TPH_LOC_CAP) { > 1137 int sts; > 1138 > CID 714665: Uninitialized scalar variable (UNINIT) [select issue] > > CID 715156 (#1 of 1): Operands don't affect result (CONSTANT_EXPRESSION_RESULT) > result_independent_of_operands: byte & 0x7ff0000 is always 0 > regardless of the values of its operands. This occurs as the operand > of assignment. > 1139 sts = byte & PCI_TPH_CAP_ST_MASK; Yes, using byte looks like a cut-n-paste error, it should have been dword. The size calculation also looks wrong since the field is an N-1 value but we don't seem to be incrementing it. I'll post a patch that fixes both. Thanks, Alex