linux-kernel - Uninitialized variable in bfad_im_bsg_els_ct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 18 Dec 2016 21:44:27 +0100
From:   Nicolas Iooss <nicolas.iooss_linux@....org>
To:     Anil Gurumurthy <anil.gurumurthy@...gic.com>,
        Sudarsana Kalluru <sudarsana.kalluru@...gic.com>,
        "James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Johannes Thumshirn <jthumshirn@...e.de>
Cc:     linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Uninitialized variable in bfad_im_bsg_els_ct_request

Hello,

Currently on Linus master tree and in linux-next [1],
bfad_im_bsg_els_ct_request() code starts with the following code:

int
bfad_im_bsg_els_ct_request(struct bsg_job *job)
{
	/*...*/
	struct fc_bsg_request *bsg_request = bsg_request;
	struct fc_bsg_reply *bsg_reply = job->reply;
	uint32_t command_type = bsg_request->msgcode;

The local variable "bsg_request" is initialized to itself (which would
usually mean it is uninitialized) but it is dereferenced in order to get
its "msgcode" field. As I am quite new to the kernel code and
dereferencing self-initialized local variables looks black magic to me,
could you please describe why this code is valid?

It has recently been introduced by commit 01e0e15c8b3b ("scsi: don't use
fc_bsg_job::request and fc_bsg_job::reply directly").

Thanks,
Nicolas Iooss

[1]
https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/tree/drivers/scsi/bfa/bfad_bsg.c?id=06548160dfecd1983ffd9d6795242a5cda095da5#n3356