linux-kernel - Re: [PATCH 1/5] MIPS: Don't use bc_false uninitialized in __mm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 12 Aug 2019 04:47:15 +0000
From:   Paul Burton <paul.burton@...s.com>
To:     Nathan Chancellor <natechancellor@...il.com>
CC:     Ralf Baechle <ralf@...ux-mips.org>,
        Paul Burton <pburton@...ecomp.com>,
        James Hogan <jhogan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "clang-built-linux@...glegroups.com" 
        <clang-built-linux@...glegroups.com>,
        Nathan Chancellor <natechancellor@...il.com>,
        "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>
Subject: Re: [PATCH 1/5] MIPS: Don't use bc_false uninitialized in
  __mm_isBranchInstr

Hello,

Nathan Chancellor wrote:
> clang warns:
> 
> arch/mips/kernel/branch.c:148:8: error: variable 'bc_false' is used
> uninitialized whenever switch case is taken
> [-Werror,-Wsometimes-uninitialized]
>                 case mm_bc2t_op:
>                      ^~~~~~~~~~
> arch/mips/kernel/branch.c:157:8: note: uninitialized use occurs here
>                         if (bc_false)
>                             ^~~~~~~~
> arch/mips/kernel/branch.c:149:8: error: variable 'bc_false' is used
> uninitialized whenever switch case is taken
> [-Werror,-Wsometimes-uninitialized]
>                 case mm_bc1t_op:
>                      ^~~~~~~~~~
> arch/mips/kernel/branch.c:157:8: note: uninitialized use occurs here
>                         if (bc_false)
>                             ^~~~~~~~
> arch/mips/kernel/branch.c:142:4: note: variable 'bc_false' is declared
> here
>                         int bc_false = 0;
>                         ^
> 2 errors generated.
> 
> When mm_bc1t_op and mm_bc2t_op are taken, the bc_false initialization
> does not happen, which leads to a garbage value upon use, as illustrated
> below with a small sample program.
> 
> $ mipsel-linux-gnu-gcc --version | head -n1
> mipsel-linux-gnu-gcc (Debian 8.3.0-2) 8.3.0
> 
> $ clang --version | head -n1
> ClangBuiltLinux clang version 9.0.0 (git://github.com/llvm/llvm-project
> 544315b4197034a3be8acd12cba56a75fb1f08dc) (based on LLVM 9.0.0svn)
> 
> $ cat test.c
>  #include <stdio.h>
> 
>  static void switch_scoped(int opcode)
>  {
> 	 switch (opcode) {
> 	 case 1:
> 	 case 2: {
> 		 int bc_false = 0;
> 
> 		 bc_false = 4;
> 	 case 3:
> 	 case 4:
> 		 printf("\t* switch scoped bc_false = %d\n", bc_false);
> 	 }
> 	 }
>  }
> 
>  static void function_scoped(int opcode)
>  {
> 	 int bc_false = 0;
> 
> 	 switch (opcode) {
> 	 case 1:
> 	 case 2: {
> 		 bc_false = 4;
> 	 case 3:
> 	 case 4:
> 		 printf("\t* function scoped bc_false = %d\n", bc_false);
> 	 }
> 	 }
>  }
> 
>  int main(void)
>  {
> 	 int opcode;
> 
> 	 for (opcode = 1; opcode < 5; opcode++) {
> 		 printf("opcode = %d:\n", opcode);
> 		 switch_scoped(opcode);
> 		 function_scoped(opcode);
> 		 printf("\n");
> 	 }
> 
> 	 return 0;
>  }
> 
> $ mipsel-linux-gnu-gcc -std=gnu89 -static test.c && \
>   qemu-mipsel a.out
> opcode = 1:
>         * switch scoped bc_false = 4
>         * function scoped bc_false = 4
> 
> opcode = 2:
>         * switch scoped bc_false = 4
>         * function scoped bc_false = 4
> 
> opcode = 3:
>         * switch scoped bc_false = 2147483004
>         * function scoped bc_false = 0
> 
> opcode = 4:
>         * switch scoped bc_false = 2147483004
>         * function scoped bc_false = 0
> 
> $ clang -std=gnu89 --target=mipsel-linux-gnu -m32 -static test.c && \
>   qemu-mipsel a.out
> opcode = 1:
>         * switch scoped bc_false = 4
>         * function scoped bc_false = 4
> 
> opcode = 2:
>         * switch scoped bc_false = 4
>         * function scoped bc_false = 4
> 
> opcode = 3:
>         * switch scoped bc_false = 2147483004
>         * function scoped bc_false = 0
> 
> opcode = 4:
>         * switch scoped bc_false = 2147483004
>         * function scoped bc_false = 0
> 
> Move the definition up so that we get the right behavior and mark it
> __maybe_unused as it will not be used when CONFIG_MIPS_FP_SUPPORT
> isn't enabled.

Applied to mips-next.

> commit c2869aafe719
> https://git.kernel.org/mips/c/c2869aafe719
> 
> Fixes: 6a1cc218b9cc ("MIPS: branch: Remove FP branch handling when CONFIG_MIPS_FP_SUPPORT=n")
> Link: https://github.com/ClangBuiltLinux/linux/issues/603
> Signed-off-by: Nathan Chancellor <natechancellor@...il.com>
> Signed-off-by: Paul Burton <paul.burton@...s.com>

Thanks,
    Paul

[ This message was auto-generated; if you believe anything is incorrect
  then please email paul.burton@...s.com to report it. ]