netdev - Re: [PATCH net] ipv6: Fix may be used uninitialized warning in rt6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 25 Aug 2017 11:02:06 +0200
From:   Stefano Brivio <sbrivio@...hat.com>
To:     Steffen Klassert <steffen.klassert@...unet.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Wei Wang <weiwan@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        "Martin KaFai Lau" <kafai@...com>, <netdev@...r.kernel.org>
Subject: Re: [PATCH net] ipv6: Fix may be used uninitialized warning in
 rt6_check

On Fri, 25 Aug 2017 09:52:17 +0200
Steffen Klassert <steffen.klassert@...unet.com> wrote:

> On Fri, Aug 25, 2017 at 09:05:42AM +0200, Steffen Klassert wrote:
> > rt_cookie might be used uninitialized, fix this by
> > initializing it.
> > 
> > Fixes: c5cff8561d2d ("ipv6: add rcu grace period before freeing fib6_node")
> > Signed-off-by: Steffen Klassert <steffen.klassert@...unet.com>
> > ---
> >  net/ipv6/route.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> > index a9d3564..48c8c92 100644
> > --- a/net/ipv6/route.c
> > +++ b/net/ipv6/route.c
> > @@ -1289,7 +1289,7 @@ static void rt6_dst_from_metrics_check(struct rt6_info *rt)
> >  
> >  static struct dst_entry *rt6_check(struct rt6_info *rt, u32 cookie)
> >  {
> > -	u32 rt_cookie;
> > +	u32 rt_cookie = 0;
> >  
> >  	if (!rt6_get_cookie_safe(rt, &rt_cookie) || rt_cookie != cookie)
> >  		return NULL;  
> 
> The compiler warning seems to be a false positive, as
> rt_cookie != cookie is only checked if rt6_get_cookie_safe
> returns true in which case rt_cookie is initialized.
> 
> Please disregard this patch.

...or not? I was thinking of sending a similar patch with
uninitialized_var(rt_cookie), but it seems we have similar cases
where we just initialize to zero instead.

I wonder which approach is considered the most acceptable nowadays. I
would be in favour of uninitialized_var() as it doesn't change the
binary output, but https://lwn.net/Articles/529954/ also contains some
valid criticism. Ideas?


--
Stefano