linux-kernel - Re: [git patches 1/2] warnings: attack valid cases spotted by warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 17 Jul 2007 15:19:06 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Roland Dreier <rdreier@...co.com>
Cc:	Jeff Garzik <jgarzik@...hat.com>, torvalds@...ux-foundation.org,
	linux-kernel@...r.kernel.org, linux-ide@...r.kernel.org,
	chas@....nrl.navy.mil, rolandd@...co.com, dwmw2@...radead.org,
	gregkh@...e.de
Subject: Re: [git patches 1/2] warnings: attack valid cases spotted by
 warnings

On Tue, 17 Jul 2007 14:53:02 -0700
Roland Dreier <rdreier@...co.com> wrote:

> >     drivers/infiniband/hw/mthca/mthca_qp: kill uninit'd var warning
> >     
> >     drivers/infiniband/hw/mthca/mthca_qp.c: In function
> >       ______mthca_tavor_post_send______:
> >     drivers/infiniband/hw/mthca/mthca_qp.c:1594: warning: ______f0______ may be used
> >       uninitialized in this function

(rofl, look at that mess: it was utterly impractical, unrealistic and
stupid for gcc to go and UTFify the compiler output.  Sigh.  LANG=C, guys).

> And I don't like using uninitialized_var() here for a similar
> reason... the functions are complex and I would prefer to avoid hiding
> future bugs that may creep in. 

umm, the code *already* produces a warning.  So if you later add a
real used-uninitialised bug, you won't know about it, because everyone
was trained to ignore the warning anyway.

Best would be to find some way to restructure the code to make the warning
go away.

Meanwhile I'd say switch this to uninitialized_var() if it's that much of a
worry.

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/