U-Boot Archive on lore.kernel.org
 help / color / mirror / Atom feed
From: Yao Zi <ziyao@disroot.org>
To: Andrew Goodbody <andrew.goodbody@linaro.org>,
	Tom Rini <trini@konsulko.com>
Cc: u-boot@lists.denx.de
Subject: Re: [PATCH] boot: Ensure that ranges is not used uninitialised
Date: Fri, 27 Jun 2025 12:23:31 +0000	[thread overview]
Message-ID: <aF6NQ2zt5qKS0UsD@pie> (raw)
In-Reply-To: <20250627-boot_fdt_fix-v1-1-d2e0c4b13762@linaro.org>

On Fri, Jun 27, 2025 at 12:51:02PM +0100, Andrew Goodbody wrote:
> The local variable ranges may be used uninitialised if the function
> fdt_get_dma_range is called with node < 0. Ensure this does not
> happen by initialising ranges when declared.

It doesn't harm. When node < 0, parent is less than zero as well, and
the first while loop is skipped. The control flow just fails into the
error path where parent < 0 stays true.

Furthermore, it doesn't seem valid to call fdt_get_dma_range() with a
negative node parameter, does it?

> /**
>  * fdt_get_dma_range() - get DMA ranges to perform bus/cpu translations
>  *
>  * @blob: pointer to device tree blob
>  * @node_offset: node DT offset
>  * @cpu: pointer to variable storing the range's cpu address
>  * @bus: pointer to variable storing the range's bus address
>  * @size: pointer to variable storing the range's size
>  *
>  * Get DMA ranges for a specifc node, this is useful to perform bus->cpu and
>  * cpu->bus address translations
>  *
>  * Return: translated DMA address or OF_BAD_ADDR on error
>  */
> int fdt_get_dma_range(const void *blob, int node_offset, phys_addr_t *cpu,
>                       dma_addr_t *bus, u64 *size);

Regards,
Yao Zi

> This issue was found with Smatch.
> 
> Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
> ---
>  boot/fdt_support.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/boot/fdt_support.c b/boot/fdt_support.c
> index 92f2f534ee0..4f63ce9a763 100644
> --- a/boot/fdt_support.c
> +++ b/boot/fdt_support.c
> @@ -1547,7 +1547,7 @@ int fdt_get_dma_range(const void *blob, int node, phys_addr_t *cpu,
>  {
>  	bool found_dma_ranges = false;
>  	struct of_bus *bus_node;
> -	const fdt32_t *ranges;
> +	const fdt32_t *ranges = NULL;
>  	int na, ns, pna, pns;
>  	int parent = node;
>  	int ret = 0;
> 
> ---
> base-commit: 359e3012921f2fc2d43f3c4e320a752173f82b82
> change-id: 20250627-boot_fdt_fix-e4e56d956c8a
> 
> Best regards,
> -- 
> Andrew Goodbody <andrew.goodbody@linaro.org>
> 

  reply	other threads:[~2025-06-27 12:23 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-06-27 11:51 [PATCH] boot: Ensure that ranges is not used uninitialised Andrew Goodbody
2025-06-27 12:23 ` Yao Zi [this message]
2025-06-30  9:51   ` Andrew Goodbody

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=aF6NQ2zt5qKS0UsD@pie \
    --to=ziyao@disroot.org \
    --cc=andrew.goodbody@linaro.org \
    --cc=trini@konsulko.com \
    --cc=u-boot@lists.denx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox