linux-kernel - Re: [PATCH] io_uring: Initialize variable before use

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d58921603fb8adf3bb335a9986c8c89348ab0985.camel@gmail.com>
Date:   Wed, 31 Mar 2021 14:57:25 +0500
From:   Muhammad Usama Anjum <musamaanjum@...il.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>
Cc:     Jens Axboe <axboe@...nel.dk>,
        Pavel Begunkov <asml.silence@...il.com>,
        linux-kernel@...r.kernel.org, kernel-janitors@...r.kernel.org,
        colin.king@...onical.com
Subject: Re: [PATCH] io_uring: Initialize variable before use

On Wed, 2021-03-31 at 11:48 +0300, Dan Carpenter wrote:
> On Mon, Mar 22, 2021 at 11:41:58PM +0500, Muhammad Usama Anjum wrote:
> > 1) Initialize the struct msghdr msg in the start of the function
> > 2) Uninitialized variable msg.msg_flags can get used if branch happens to
> > out_free before initialization.
> > 
> > So initialize variable in question in the start of the function for
> > simplicity in logic and use.
> > 
> > Addresses-Coverity: ("Uninitialized variable")
> > Addresses-Coverity: ("Uninitialized variable read")
> 
> This bug is a false positive.
> 
> When msg.msg_flags is uninitialized then ret is negative and min_ret is
> zero.
> 
> fs/io_uring.c
>   4666                  ret = -EINTR;
>   4667  out_free:
>   4668          if (req->flags & REQ_F_BUFFER_SELECTED)
>   4669                  cflags = io_put_recv_kbuf(req);
>   4670          if (ret < min_ret || ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))))
>                     ^^^^^^^^^^^^^                               ^^^^^^^^^^^^^
> The first part of the condition is true so the second part is not used.
> 
>   4671                  req_set_fail_links(req);
>   4672          __io_req_complete(req, issue_flags, ret, cflags);
>   4673          return 0;
>   4674  }
> 
Understood. Thank you so much!

Thanks,
Usama

> regards,
> dan carpenter
>