linux-kernel - Re: [PATCH] flow_dissector: avoid uninitialized variable access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161021163118.GA2155@nanopsycho.orion>
Date:   Fri, 21 Oct 2016 18:31:18 +0200
From:   Jiri Pirko <jiri@...nulli.us>
To:     Arnd Bergmann <arnd@...db.de>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Alexander Duyck <aduyck@...antis.com>,
        Tom Herbert <tom@...bertland.com>,
        Jiri Pirko <jiri@...lanox.com>,
        Hadar Hen Zion <hadarh@...lanox.com>,
        Gao Feng <fgao@...ai8.com>, Eric Garver <e@...g.me>,
        Amir Vadai <amir@...ai.me>, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] flow_dissector: avoid uninitialized variable access

Fri, Oct 21, 2016 at 05:55:53PM CEST, arnd@...db.de wrote:
>gcc warns about an uninitialized pointer dereference in the vlan
>priority handling:
>
>net/core/flow_dissector.c: In function '__skb_flow_dissect':
>net/core/flow_dissector.c:281:61: error: 'vlan' may be used uninitialized in this function [-Werror=maybe-uninitialized]
>
>>From all I can tell, this warning is about a real bug, and we
>should not attempt look up the vlan header if there was
>no vlan tag.

I don't see how vlan could be used uninitialized. But I understand that
this is impossible for gcc to track it. Please just use uninitialized_var()



>
>Fixes: f6a66927692e ("flow_dissector: Get vlan priority in addition to vlan id")
>Signed-off-by: Arnd Bergmann <arnd@...db.de>
>---
>I'm not sure about this one, please have a closer look at what
>the original code does before applying.
>---
> net/core/flow_dissector.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
>diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
>index 44e6ba9d3a6b..dd6003bf27e1 100644
>--- a/net/core/flow_dissector.c
>+++ b/net/core/flow_dissector.c
>@@ -245,7 +245,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
> 	}
> 	case htons(ETH_P_8021AD):
> 	case htons(ETH_P_8021Q): {
>-		const struct vlan_hdr *vlan;
>+		const struct vlan_hdr *vlan = NULL;
> 
> 		if (skb && skb_vlan_tag_present(skb))
> 			proto = skb->protocol;
>@@ -264,7 +264,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
> 		}
> 
> 		skip_vlan = true;
>-		if (dissector_uses_key(flow_dissector,
>+		if (vlan && dissector_uses_key(flow_dissector,
> 				       FLOW_DISSECTOR_KEY_VLAN)) {
> 			key_vlan = skb_flow_dissector_target(flow_dissector,
> 							     FLOW_DISSECTOR_KEY_VLAN,
>-- 
>2.9.0
>