linux-kernel - [PATCH -next] io_uring: Ensure mask is initialized in io_arm_poll

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200302230118.12060-1-natechancellor@gmail.com>
Date:   Mon,  2 Mar 2020 16:01:19 -0700
From:   Nathan Chancellor <natechancellor@...il.com>
To:     Jens Axboe <axboe@...nel.dk>
Cc:     io-uring@...r.kernel.org, linux-kernel@...r.kernel.org,
        clang-built-linux@...glegroups.com,
        Nathan Chancellor <natechancellor@...il.com>
Subject: [PATCH -next] io_uring: Ensure mask is initialized in io_arm_poll_handler

Clang warns:

fs/io_uring.c:4178:6: warning: variable 'mask' is used uninitialized
whenever 'if' condition is false [-Wsometimes-uninitialized]
        if (def->pollin)
            ^~~~~~~~~~~
fs/io_uring.c:4182:2: note: uninitialized use occurs here
        mask |= POLLERR | POLLPRI;
        ^~~~
fs/io_uring.c:4178:2: note: remove the 'if' if its condition is always
true
        if (def->pollin)
        ^~~~~~~~~~~~~~~~
fs/io_uring.c:4154:15: note: initialize the variable 'mask' to silence
this warning
        __poll_t mask, ret;
                     ^
                      = 0
1 warning generated.

io_op_defs has many definitions where pollin is not set so mask indeed
might be uninitialized. Initialize it to zero and change the next
assignment to |=, in case further masks are added in the future to avoid
missing changing the assignment then.

Fixes: d7718a9d25a6 ("io_uring: use poll driven retry for files that support it")
Link: https://github.com/ClangBuiltLinux/linux/issues/916
Signed-off-by: Nathan Chancellor <natechancellor@...il.com>
---

I noticed that for-next has been force pushed; if you want to squash
this into the commit that it fixes (or fix it in a different way), feel
free.

 fs/io_uring.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 8cdd3870cd4e..70e4624af3c2 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3738,8 +3738,9 @@ static bool io_arm_poll_handler(struct io_kiocb *req)
 	req->apoll = apoll;
 	INIT_HLIST_NODE(&req->hash_node);
 
+	mask = 0;
 	if (def->pollin)
-		mask = POLLIN | POLLRDNORM;
+		mask |= POLLIN | POLLRDNORM;
 	if (def->pollout)
 		mask |= POLLOUT | POLLWRNORM;
 	mask |= POLLERR | POLLPRI;
-- 
2.25.1