linux-kernel - Re: [PATCH 2/3] mm: vmalloc: fix vmap_ram_vread

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <0958ea78-c299-478b-8840-f1cafd893771@lucifer.local>
Date:   Thu, 23 Mar 2023 12:05:28 +0000
From:   Lorenzo Stoakes <lstoakes@...il.com>
To:     Arnd Bergmann <arnd@...nel.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Arnd Bergmann <arnd@...db.de>,
        Uladzislau Rezki <urezki@...il.com>,
        Christoph Hellwig <hch@...radead.org>,
        Baoquan He <bhe@...hat.com>,
        David Hildenbrand <david@...hat.com>,
        Andrey Konovalov <andreyknvl@...il.com>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/3] mm: vmalloc: fix vmap_ram_vread_iter() return value

On Thu, Mar 23, 2023 at 12:58:35PM +0100, Arnd Bergmann wrote:
> From: Arnd Bergmann <arnd@...db.de>
>
> The error handling in vmap_ram_vread_iter() can return an
> uninitialized value in some cases:
>
> mm/vmalloc.c:3539:6: error: variable 'remains' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
>         if (!vb)
>             ^~~
> mm/vmalloc.c:3587:17: note: uninitialized use occurs here
>         return count - remains + zero_iter(iter, remains);
>                        ^~~~~~~
>
> Move the initialization up a few lines.
>
> Fixes: d9cab54f7737 ("mm: vmalloc: convert vread() to vread_iter()")
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> ---
>  mm/vmalloc.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index ebfa1e9fe6f9..fb216495fe5a 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -3521,7 +3521,7 @@ static size_t vmap_ram_vread_iter(struct iov_iter *iter, const char *addr,
>  	struct vmap_block *vb;
>  	unsigned long offset;
>  	unsigned int rs, re;
> -	size_t remains, n;
> +	size_t remains = count, n;
>
>  	/*
>  	 * If it's area created by vm_map_ram() interface directly, but
> @@ -3545,7 +3545,6 @@ static size_t vmap_ram_vread_iter(struct iov_iter *iter, const char *addr,
>  		goto finished_zero;
>  	}
>
> -	remains = count;
>  	for_each_set_bitrange(rs, re, vb->used_map, VMAP_BBMAP_BITS) {
>  		size_t copied;
>
> --
> 2.39.2
>
>

This was also already fixed in a more recent version of this patch set, in
v5 I believe. Again apologies for this!

Latest version at
https://lore.kernel.org/all/cover.1679566220.git.lstoakes@gmail.com