linux-kernel - Re: [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <91e8ca64-0670-d998-73d8-f75ec5264cb0@kernel.dk>
Date:   Mon, 7 Feb 2022 06:45:57 -0700
From:   Jens Axboe <axboe@...nel.dk>
To:     Ammar Faizi <ammarfaizi2@...weeb.org>
Cc:     GNU/Weeb Mailing List <gwml@...weeb.org>,
        io-uring Mailing list <io-uring@...r.kernel.org>,
        Tea Inside Mailing List <timl@...r.teainside.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Alviro Iskandar Setiawan <alviro.iskandar@...il.com>,
        kernel test robot <lkp@...el.com>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        "Chen, Rong A" <rong.a.chen@...el.com>,
        Pavel Begunkov <asml.silence@...il.com>
Subject: Re: [PATCH io_uring-5.17] io_uring: Fix build error potential reading
 uninitialized value

On 2/7/22 4:43 AM, Ammar Faizi wrote:
> From: Alviro Iskandar Setiawan <alviro.iskandar@...il.com>
> 
> In io_recv() if import_single_range() fails, the @flags variable is
> uninitialized, then it will goto out_free.
> 
> After the goto, the compiler doesn't know that (ret < min_ret) is
> always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
> could be taken.
> 
> The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
> ```
>   fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
> ```
> Fix this by bypassing the @ret and @flags check when
> import_single_range() fails.

The compiler should be able to deduce this, and I guess newer compilers
do which is why we haven't seen this warning before. I'm fine with doing
this as a cleanup, but I think the commit title should be modified a
bit. It sounds like there might be an issue reading uninitialized data,
which isn't actually true.

-- 
Jens Axboe