[PATCH v2] usb: typec: qcom-pmic-typec: avoid uninit values in dev_dbg() error paths

Vasiliy Kovalev posted 1 patch 1 week, 4 days ago
drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
[PATCH v2] usb: typec: qcom-pmic-typec: avoid uninit values in dev_dbg() error paths
Posted by Vasiliy Kovalev 1 week, 4 days ago
Several functions take a 'goto done' shortcut on regmap_read() (or
switch default) failure before assigning locals that the trailing
dev_dbg() then formats.

Initialize the affected locals at declaration. For 'currsrc' in
qcom_pmic_typec_port_set_cc(), use an out-of-range 0xFF rather than 0,
since 0 is a valid value that maps to TYPEC_SRC_RP_SEL_80UA and would
be indistinguishable from a successful assignment in the debug log.

Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.

Suggested-by: Alexey V. Vissarionov <gremlin@altlinux.org>
Fixes: a4422ff22142 ("usb: typec: qcom: Add Qualcomm PMIC Type-C driver")
Cc: stable@vger.kernel.org
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
---
v2:
 - Initialize currsrc to 0xFF instead of 0, so it stays distinguishable
   from the valid TYPEC_SRC_RP_SEL_80UA value in the debug output
   (suggested by Alexey V. Vissarionov : https://lore.kernel.org/all/20260713182500.GB22956@altlinux.org/).
 - Collect Reviewed-by from Bryan and Heikki on v1.

v1: https://lore.kernel.org/all/20260630120114.185169-1-kovalev@altlinux.org/
---
 drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
index bf985efe1cd6..73270e4846c2 100644
--- a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
+++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port.c
@@ -366,7 +366,7 @@ static int qcom_pmic_typec_port_get_cc(struct tcpc_dev *tcpc,
 	struct pmic_typec_port *pmic_typec_port = tcpm->pmic_typec_port;
 	struct device *dev = pmic_typec_port->dev;
 	unsigned int misc, val;
-	bool attached;
+	bool attached = false;
 	int ret = 0;
 
 	ret = regmap_read(pmic_typec_port->regmap,
@@ -461,8 +461,8 @@ static int qcom_pmic_typec_port_set_cc(struct tcpc_dev *tcpc,
 	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
 	struct pmic_typec_port *pmic_typec_port = tcpm->pmic_typec_port;
 	struct device *dev = pmic_typec_port->dev;
-	unsigned int mode, currsrc;
-	unsigned int misc;
+	unsigned int currsrc = 0xFF; /* invalid; 0 is a valid TYPEC_SRC_RP_SEL_80UA */
+	unsigned int mode = 0, misc = 0;
 	unsigned long flags;
 	int ret;
 
@@ -535,7 +535,8 @@ static int qcom_pmic_typec_port_set_vconn(struct tcpc_dev *tcpc, bool on)
 	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
 	struct pmic_typec_port *pmic_typec_port = tcpm->pmic_typec_port;
 	struct device *dev = pmic_typec_port->dev;
-	unsigned int orientation, misc, mask, value;
+	unsigned int orientation = 0, misc = 0, value = 0;
+	unsigned int mask;
 	unsigned long flags;
 	int ret;
 
-- 
2.50.1