From: Colin Ian King <colin.king@canonical.com>
To: Takashi Iwai <tiwai@suse.com>
Cc: Jaroslav Kysela <perex@perex.cz>,
alsa-devel@alsa-project.org,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: re: ALSA: usb-audio: Handle error for the current selector gracefully [ uninitialized variable issue ]
Date: Thu, 20 May 2021 09:58:21 +0100 [thread overview]
Message-ID: <4b261d68-f53f-240d-2d8a-2f88b337849d@canonical.com> (raw)
Hi,
Static analysis with Coverity on linux-next has detected an
uninitialized variable issue with the following commit:
commit 481f17c41803985446fd12887b2c042f9c43b0d5
Author: Takashi Iwai <tiwai@suse.de>
Date: Tue May 18 17:21:12 2021 +0200
ALSA: usb-audio: Handle error for the current selector gracefully
The branching is a bit convoluted and we end up with variable cur not
being initialized. Analysis is as follows:
254static int __uac_clock_find_source(struct snd_usb_audio *chip,
255 const struct audioformat *fmt, int
entity_id,
256 unsigned long *visited, bool validate)
257{
258 union uac23_clock_source_desc *source;
259 union uac23_clock_selector_desc *selector;
260 union uac23_clock_multiplier_desc *multiplier;
1. var_decl: Declaring variable cur without initializer.
261 int ret, i, cur, err, pins, clock_id;
262 const u8 *sources;
263 int proto = fmt->protocol;
264
265 entity_id &= 0xff;
266
2. Condition test_and_set_bit(entity_id, visited), taking false
branch.
267 if (test_and_set_bit(entity_id, visited)) {
268 usb_audio_warn(chip,
269 "%s(): recursive clock topology detected, id
%d.\n",
270 __func__, entity_id);
271 return -EINVAL;
272 }
273
274 /* first, see if the ID we're looking for is a clock source
already */
275 source = snd_usb_find_clock_source(chip, entity_id, proto);
3. Condition source, taking false branch.
276 if (source) {
277 entity_id = GET_VAL(source, proto, bClockID);
278 if (validate && !uac_clock_source_is_valid(chip, fmt,
279
entity_id)) {
280 usb_audio_err(chip,
281 "clock source %d is not valid, cannot
use\n",
282 entity_id);
283 return -ENXIO;
284 }
285 return entity_id;
286 }
287
288 selector = snd_usb_find_clock_selector(chip, entity_id, proto);
4. Condition selector, taking true branch.
289 if (selector) {
5. Condition proto == 48, taking true branch.
290 pins = GET_VAL(selector, proto, bNrInPins);
6. Condition proto == 48, taking true branch.
291 clock_id = GET_VAL(selector, proto, bClockID);
7. Condition proto == 48, taking true branch.
292 sources = GET_VAL(selector, proto, baCSourceID);
293
8. Condition pins == 1, taking false branch.
294 if (pins == 1) {
295 ret = 1;
296 goto find_source;
297 }
298
299 /* the entity ID we are looking for is a selector.
300 * find out what it currently selects */
301 ret = uac_clock_selector_get_val(chip, clock_id);
9. Condition ret < 0, taking true branch.
302 if (ret < 0) {
10. Condition !chip->autoclock, taking false branch.
303 if (!chip->autoclock)
304 return ret;
11. Jumping to label find_others.
305 goto find_others;
306 }
307
308 /* Selector values are one-based */
309
310 if (ret > pins || ret < 1) {
311 usb_audio_err(chip,
312 "%s(): selector reported illegal
value, id %d, ret %d\n",
313 __func__, clock_id, ret);
314
315 if (!chip->autoclock)
316 return -EINVAL;
317 ret = 0;
318 goto find_others;
319 }
320
321 find_source:
322 cur = ret;
323 ret = __uac_clock_find_source(chip, fmt,
324 sources[ret - 1],
325 visited, validate);
326 if (ret > 0) {
327 err = uac_clock_selector_set_val(chip,
entity_id, cur);
328 if (err < 0)
329 return err;
330 }
331
332 if (!validate || ret > 0 || !chip->autoclock)
333 return ret;
334
335 find_others:
336 /* The current clock source is invalid, try others. */
12. Condition i <= pins, taking true branch.
337 for (i = 1; i <= pins; i++) {
Uninitialized scalar variable (UNINIT)
13. uninit_use: Using uninitialized value cur.
338 if (i == cur)
339 continue;
340
Colin
next reply other threads:[~2021-05-20 8:58 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-20 8:58 Colin Ian King [this message]
2021-05-20 12:37 ` ALSA: usb-audio: Handle error for the current selector gracefully [ uninitialized variable issue ] Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4b261d68-f53f-240d-2d8a-2f88b337849d@canonical.com \
--to=colin.king@canonical.com \
--cc=alsa-devel@alsa-project.org \
--cc=linux-kernel@vger.kernel.org \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).