[Linux-stm32] [PATCH] iio: adc: stm32-dfsdm: Fix the uninitialized use if regmap_read() fails

[Olivier MOYSAN]

Hi,

On 7/24/21 5:48 PM, Jonathan Cameron wrote:
> On Mon, 19 Jul 2021 19:53:11 +0000
> Yizhuo <yzhai003 at ucr.edu> wrote:
> 
>> Inside function stm32_dfsdm_irq(), the variable "status", "int_en"
>> could be uninitialized if the regmap_read() fails and returns an error
>> code.  However, they are directly used in the later context to decide
>> the control flow, which is potentially unsafe.
>>
>> Fixes: e2e6771c64625 ("IIO: ADC: add STM32 DFSDM sigma delta ADC support")
>>
>> Signed-off-by: Yizhuo <yzhai003 at ucr.edu>
> 
> Hi Yizhou
> 
> I want to get some review of this from people familiar with the
> hardware as there is a small possibility your reordering might have
> introduced a problem.
> 

I cannot see side effects with reordering itself.
However, if we get an error with the read access, just leaving with
irq_handled status is probably not enough.
In such case we are facing a serious issue and it would make sense to 
also mask dfsdm interrupts and log a trace.
There are three regmap_read() calls in the irq handler. I think that 
checking the first call is enough. This would also avoid to re-order the 
following regmap_read.

BRs
Olivier

>> ---
>>   drivers/iio/adc/stm32-dfsdm-adc.c | 9 +++++++--
>>   1 file changed, 7 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/iio/adc/stm32-dfsdm-adc.c b/drivers/iio/adc/stm32-dfsdm-adc.c
>> index 1cfefb3b5e56..d8b78aead942 100644
>> --- a/drivers/iio/adc/stm32-dfsdm-adc.c
>> +++ b/drivers/iio/adc/stm32-dfsdm-adc.c
>> @@ -1292,9 +1292,11 @@ static irqreturn_t stm32_dfsdm_irq(int irq, void *arg)
>>   	struct stm32_dfsdm_adc *adc = iio_priv(indio_dev);
>>   	struct regmap *regmap = adc->dfsdm->regmap;
>>   	unsigned int status, int_en;
>> +	int ret;
>>   
>> -	regmap_read(regmap, DFSDM_ISR(adc->fl_id), &status);
>> -	regmap_read(regmap, DFSDM_CR2(adc->fl_id), &int_en);
> 
> Moving this later is only valid if there aren't any side effects.
> The current ordering is strange enough it makes me wonder if there might be!
> 
> Jonathan
> 
>> +	ret = regmap_read(regmap, DFSDM_ISR(adc->fl_id), &status);
>> +	if (ret)
>> +		return IRQ_HANDLED;
>>   
>>   	if (status & DFSDM_ISR_REOCF_MASK) {
>>   		/* Read the data register clean the IRQ status */
>> @@ -1303,6 +1305,9 @@ static irqreturn_t stm32_dfsdm_irq(int irq, void *arg)
>>   	}
>>   
>>   	if (status & DFSDM_ISR_ROVRF_MASK) {
>> +		ret = regmap_read(regmap, DFSDM_CR2(adc->fl_id), &int_en);
>> +		if (ret)
>> +			return IRQ_HANDLED;
>>   		if (int_en & DFSDM_CR2_ROVRIE_MASK)
>>   			dev_warn(&indio_dev->dev, "Overrun detected\n");
>>   		regmap_update_bits(regmap, DFSDM_ICR(adc->fl_id),
> 
> _______________________________________________
> Linux-stm32 mailing list
> Linux-stm32 at st-md-mailman.stormreply.com
> https://st-md-mailman.stormreply.com/mailman/listinfo/linux-stm32
>