linux-kernel - Re: [PATCH 2/5] rxrpc: Fix uninitialized error code in rxrpc_send_data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAK8P3a1wTED5Aet_9AjY9VFFrutkV2xK6C13vroTLd0vpcoo9w@mail.gmail.com>
Date:   Wed, 29 May 2019 13:49:52 +0200
From:   Arnd Bergmann <arnd@...db.de>
To:     Geert Uytterhoeven <geert@...ux-m68k.org>
Cc:     Igor Konopko <igor.j.konopko@...el.com>,
        David Howells <dhowells@...hat.com>,
        "Mohit P . Tahiliani" <tahiliani@...k.edu.in>,
        Takashi Sakamoto <o-takashi@...amocchi.jp>,
        Eran Ben Elisha <eranbe@...lanox.com>,
        Matias Bjorling <mb@...htnvm.io>,
        Jiri Pirko <jiri@...lanox.com>,
        "David S . Miller" <davem@...emloft.net>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Cong Wang <xiyou.wangcong@...il.com>,
        Clemens Ladisch <clemens@...isch.de>,
        Jaroslav Kysela <perex@...ex.cz>,
        Takashi Iwai <tiwai@...e.com>, Joe Perches <joe@...ches.com>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        linux-block <linux-block@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        linux-afs@...ts.infradead.org,
        ALSA Development Mailing List <alsa-devel@...a-project.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        clang-built-linux <clang-built-linux@...glegroups.com>
Subject: Re: [PATCH 2/5] rxrpc: Fix uninitialized error code in rxrpc_send_data_packet()

On Tue, May 28, 2019 at 4:24 PM Geert Uytterhoeven <geert@...ux-m68k.org> wrote:
>
> With gcc 4.1:
>
>     net/rxrpc/output.c: In function ‘rxrpc_send_data_packet’:
>     net/rxrpc/output.c:338: warning: ‘ret’ may be used uninitialized in this function
>
> Indeed, if the first jump to the send_fragmentable label is made, and
> the address family is not handled in the switch() statement, ret will be
> used uninitialized.
>
> Fix this by initializing err to zero before the jump, like is already
> done for the jump to the done label.
>
> Fixes: 5a924b8951f835b5 ("rxrpc: Don't store the rxrpc header in the Tx queue sk_buffs")
> Signed-off-by: Geert Uytterhoeven <geert@...ux-m68k.org>
> ---
> While this is not a real false-positive, I believe it cannot cause harm
> in practice, as AF_RXRPC cannot be used with other transport families
> than IPv4 and IPv6.

This looks like a variant of the infamous bug
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=18501

What I don't understand is why clang fails to warn about it with
-Wsometimes-uninitialized.
(cc clang-built-linux mailing list).

      Arnd

>  net/rxrpc/output.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
> index 004c762c2e8d063c..1473d774d67100c5 100644
> --- a/net/rxrpc/output.c
> +++ b/net/rxrpc/output.c
> @@ -403,8 +403,10 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb,
>
>         /* send the packet with the don't fragment bit set if we currently
>          * think it's small enough */
> -       if (iov[1].iov_len >= call->peer->maxdata)
> +       if (iov[1].iov_len >= call->peer->maxdata) {
> +               ret = 0;
>                 goto send_fragmentable;
> +       }
>
>         down_read(&conn->params.local->defrag_sem);
>