linux-kernel - Re: [PATCH][next] io_uring: Fix uninitialized variable up.resv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <681850b0-fe2a-ae9e-a55b-6788fce71a8e@gmail.com>
Date:   Mon, 26 Apr 2021 11:07:54 +0100
From:   Pavel Begunkov <asml.silence@...il.com>
To:     Colin Ian King <colin.king@...onical.com>,
        Jens Axboe <axboe@...nel.dk>, io-uring@...r.kernel.org
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] io_uring: Fix uninitialized variable up.resv

On 4/26/21 11:01 AM, Colin Ian King wrote:
> On 26/04/2021 10:59, Pavel Begunkov wrote:
>> On 4/26/21 10:47 AM, Colin King wrote:
>>> From: Colin Ian King <colin.king@...onical.com>
>>>
>>> The variable up.resv is not initialized and is being checking for a
>>> non-zero value in the call to _io_register_rsrc_update. Fix this by
>>> explicitly setting the pointer to 0.
> 
>                           ^^ s/pointer/variable/
> 
> Shall I send a V2?

If you like, but if you don't want to resend it's not important, or
Jens can edit it while applying.

> 
>>
>> LGTM, thanks Colin
>>
>>
>>> Addresses-Coverity: ("Uninitialized scalar variable)"
>>> Fixes: c3bdad027183 ("io_uring: add generic rsrc update with tags")
>>> Signed-off-by: Colin Ian King <colin.king@...onical.com>
>>> ---
>>>  fs/io_uring.c | 1 +
>>>  1 file changed, 1 insertion(+)
>>>
>>> diff --git a/fs/io_uring.c b/fs/io_uring.c
>>> index f4ec092c23f4..63f610ee274b 100644
>>> --- a/fs/io_uring.c
>>> +++ b/fs/io_uring.c
>>> @@ -5842,6 +5842,7 @@ static int io_files_update(struct io_kiocb *req, unsigned int issue_flags)
>>>  	up.data = req->rsrc_update.arg;
>>>  	up.nr = 0;
>>>  	up.tags = 0;
>>> +	up.resv = 0;
>>>  
>>>  	mutex_lock(&ctx->uring_lock);
>>>  	ret = __io_register_rsrc_update(ctx, IORING_RSRC_FILE,
>>>
>>
> 

-- 
Pavel Begunkov