lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0140/1039] Bluetooth: fix uninitialized variables notify_evt
    Date
    From: Jackie Liu <liuyun01@kylinos.cn>

    [ Upstream commit a27c519a816437ec92f0ffa3adbc168c2c08725b ]

    Coverity Scan report:

    [...]
    *** CID 1493985: Uninitialized variables (UNINIT)
    /net/bluetooth/hci_event.c: 4535 in hci_sync_conn_complete_evt()
    4529
    4530 /* Notify only in case of SCO over HCI transport data path which
    4531 * is zero and non-zero value shall be non-HCI transport data path
    4532 */
    4533 if (conn->codec.data_path == 0) {
    4534 if (hdev->notify)
    >>> CID 1493985: Uninitialized variables (UNINIT)
    >>> Using uninitialized value "notify_evt" when calling "*hdev->notify".
    4535 hdev->notify(hdev, notify_evt);
    4536 }
    4537
    4538 hci_connect_cfm(conn, ev->status);
    4539 if (ev->status)
    4540 hci_conn_del(conn);
    [...]

    Although only btusb uses air_mode, and he only handles HCI_NOTIFY_ENABLE_SCO_CVSD
    and HCI_NOTIFY_ENABLE_SCO_TRANSP, there is still a very small chance that
    ev->air_mode is not equal to 0x2 and 0x3, but notify_evt is initialized to
    HCI_NOTIFY_ENABLE_SCO_CVSD or HCI_NOTIFY_ENABLE_SCO_TRANSP. the context is
    maybe not correct.

    Let us directly use the required function instead of re-initializing it,
    so as to restore the original logic and make the code more correct.

    Addresses-Coverity: ("Uninitialized variables")
    Fixes: f4f9fa0c07bb ("Bluetooth: Allow usb to auto-suspend when SCO use non-HCI transport")
    Suggested-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/bluetooth/hci_event.c | 23 +++++++++--------------
    1 file changed, 9 insertions(+), 14 deletions(-)

    diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
    index 59f0691d907f6..6eba439487749 100644
    --- a/net/bluetooth/hci_event.c
    +++ b/net/bluetooth/hci_event.c
    @@ -4445,7 +4445,6 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
    {
    struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
    struct hci_conn *conn;
    - unsigned int notify_evt;

    BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

    @@ -4517,22 +4516,18 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
    }

    bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
    -
    - switch (ev->air_mode) {
    - case 0x02:
    - notify_evt = HCI_NOTIFY_ENABLE_SCO_CVSD;
    - break;
    - case 0x03:
    - notify_evt = HCI_NOTIFY_ENABLE_SCO_TRANSP;
    - break;
    - }
    -
    /* Notify only in case of SCO over HCI transport data path which
    * is zero and non-zero value shall be non-HCI transport data path
    */
    - if (conn->codec.data_path == 0) {
    - if (hdev->notify)
    - hdev->notify(hdev, notify_evt);
    + if (conn->codec.data_path == 0 && hdev->notify) {
    + switch (ev->air_mode) {
    + case 0x02:
    + hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
    + break;
    + case 0x03:
    + hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
    + break;
    + }
    }

    hci_connect_cfm(conn, ev->status);
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 23:11    [W:3.730 / U:0.900 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site