linux-kernel - arch/powerpc/kernel/hw_breakpoint.c:715 hw_breakpoint_handler() error: uninitialized symbol 'ea'.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Mon, 3 May 2021 13:12:55 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Ravi Bangoria <ravi.bangoria@...ux.ibm.com>
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        linux-kernel@...r.kernel.org, Michael Ellerman <mpe@...erman.id.au>
Subject: arch/powerpc/kernel/hw_breakpoint.c:715 hw_breakpoint_handler()
 error: uninitialized symbol 'ea'.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   9f67672a817ec046f7554a885f0fe0d60e1bf99f
commit: f6780ce619f8daa285760302d56e95892087bd1f powerpc/watchpoint: Fix DAWR exception constraint
config: powerpc-randconfig-m031-20210501 (attached as .config)
compiler: powerpc-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

New smatch warnings:
arch/powerpc/kernel/hw_breakpoint.c:715 hw_breakpoint_handler() error: uninitialized symbol 'ea'.

vim +/ea +715 arch/powerpc/kernel/hw_breakpoint.c

03465f899bdac7 Nicholas Piggin  2016-09-16  677  int hw_breakpoint_handler(struct die_args *args)
5aae8a53708025 K.Prasad         2010-06-15  678  {
74c6881019b7d5 Ravi Bangoria    2020-05-14  679  	bool err = false;
5aae8a53708025 K.Prasad         2010-06-15  680  	int rc = NOTIFY_STOP;
74c6881019b7d5 Ravi Bangoria    2020-05-14  681  	struct perf_event *bp[HBP_NUM_MAX] = { NULL };
5aae8a53708025 K.Prasad         2010-06-15  682  	struct pt_regs *regs = args->regs;
74c6881019b7d5 Ravi Bangoria    2020-05-14  683  	struct arch_hw_breakpoint *info[HBP_NUM_MAX] = { NULL };
74c6881019b7d5 Ravi Bangoria    2020-05-14  684  	int i;
74c6881019b7d5 Ravi Bangoria    2020-05-14  685  	int hit[HBP_NUM_MAX] = {0};
74c6881019b7d5 Ravi Bangoria    2020-05-14  686  	int nr_hit = 0;
74c6881019b7d5 Ravi Bangoria    2020-05-14  687  	bool ptrace_bp = false;
74c6881019b7d5 Ravi Bangoria    2020-05-14  688  	struct ppc_inst instr = ppc_inst(0);
74c6881019b7d5 Ravi Bangoria    2020-05-14  689  	int type = 0;
74c6881019b7d5 Ravi Bangoria    2020-05-14  690  	int size = 0;
f6780ce619f8da Ravi Bangoria    2020-07-23  691  	unsigned long ea;
5aae8a53708025 K.Prasad         2010-06-15  692  
5aae8a53708025 K.Prasad         2010-06-15  693  	/* Disable breakpoints during exception handling */
9422de3e953d0e Michael Neuling  2012-12-20  694  	hw_breakpoint_disable();
574cb24899d35e Paul Mackerras   2010-06-23  695  
5aae8a53708025 K.Prasad         2010-06-15  696  	/*
5aae8a53708025 K.Prasad         2010-06-15  697  	 * The counter may be concurrently released but that can only
5aae8a53708025 K.Prasad         2010-06-15  698  	 * occur from a call_rcu() path. We can then safely fetch
5aae8a53708025 K.Prasad         2010-06-15  699  	 * the breakpoint, use its callback, touch its counter
5aae8a53708025 K.Prasad         2010-06-15  700  	 * while we are in an rcu_read_lock() path.
5aae8a53708025 K.Prasad         2010-06-15  701  	 */
5aae8a53708025 K.Prasad         2010-06-15  702  	rcu_read_lock();
5aae8a53708025 K.Prasad         2010-06-15  703  
74c6881019b7d5 Ravi Bangoria    2020-05-14  704  	if (!IS_ENABLED(CONFIG_PPC_8xx))
f6780ce619f8da Ravi Bangoria    2020-07-23  705  		get_instr_detail(regs, &instr, &type, &size, &ea);

No else path.

74c6881019b7d5 Ravi Bangoria    2020-05-14  706  
74c6881019b7d5 Ravi Bangoria    2020-05-14  707  	for (i = 0; i < nr_wp_slots(); i++) {
74c6881019b7d5 Ravi Bangoria    2020-05-14  708  		bp[i] = __this_cpu_read(bp_per_reg[i]);
74c6881019b7d5 Ravi Bangoria    2020-05-14  709  		if (!bp[i])
74c6881019b7d5 Ravi Bangoria    2020-05-14  710  			continue;
74c6881019b7d5 Ravi Bangoria    2020-05-14  711  
74c6881019b7d5 Ravi Bangoria    2020-05-14  712  		info[i] = counter_arch_bp(bp[i]);
74c6881019b7d5 Ravi Bangoria    2020-05-14  713  		info[i]->type &= ~HW_BRK_TYPE_EXTRANEOUS_IRQ;
74c6881019b7d5 Ravi Bangoria    2020-05-14  714  
f6780ce619f8da Ravi Bangoria    2020-07-23 @715  		if (check_constraints(regs, instr, ea, type, size, info[i])) {
                                                                                                   ^^
Passing uninitialized data to a function will trigger a KUBSan warning
at runtime regardless of whether or not the parameter is used.  (Unless
the compiler inlines the function then it would be fine).

74c6881019b7d5 Ravi Bangoria    2020-05-14  716  			if (!IS_ENABLED(CONFIG_PPC_8xx) &&
74c6881019b7d5 Ravi Bangoria    2020-05-14  717  			    ppc_inst_equal(instr, ppc_inst(0))) {
74c6881019b7d5 Ravi Bangoria    2020-05-14  718  				handler_error(bp[i], info[i]);
74c6881019b7d5 Ravi Bangoria    2020-05-14  719  				info[i] = NULL;
74c6881019b7d5 Ravi Bangoria    2020-05-14  720  				err = 1;
74c6881019b7d5 Ravi Bangoria    2020-05-14  721  				continue;
74c6881019b7d5 Ravi Bangoria    2020-05-14  722  			}
74c6881019b7d5 Ravi Bangoria    2020-05-14  723  
74c6881019b7d5 Ravi Bangoria    2020-05-14  724  			if (is_ptrace_bp(bp[i]))

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org