linux-kernel - Re: [PATCH] crypto: lib/mpi - Fix an "Uninitialized scalar variable" issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87tteglvnt.fsf@kamlesh.i-did-not-set--mail-host-address--so-tickle-me>
Date: Sun, 15 Sep 2024 22:08:14 +0530
From: Kamlesh Gurudasani <kamlesh@...com>
To: Qianqiang Liu <qianqiang.liu@....com>, <davem@...emloft.net>
CC: <herbert@...dor.apana.org.au>, <linux-crypto@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] crypto: lib/mpi - Fix an "Uninitialized scalar
 variable" issue

Kamlesh Gurudasani <kamlesh@...com> writes:

> Qianqiang Liu <qianqiang.liu@....com> writes:
>
>> On Fri, Sep 13, 2024 at 10:07:42PM +0800, Qianqiang Liu wrote:
>>> The "err" variable may be returned without an initialized value.
>>> 
>>> Fixes: 8e3a67f2de87 ("crypto: lib/mpi - Add error checks to extension")
>>> Signed-off-by: Qianqiang Liu <qianqiang.liu@....com>
> Thanks for the patch.
>
> You can update the commit message and subject line to be more specific.
>
> ***
> example
> Subject: crypto: lib/mpi - Fix return of uninitailized variable err
>
> If no error occurs, "err" variable will be returned with uninitialized
> value, which is actually a success case scenario and return value should
> have been zero.
My bad when I looked in detail,

   	if (!vsize)
		wsize = 0;
if this condition is true, mpihelp_mul will never be called, leaving err
uninitialized, not sure if that is success case scenario or failure.

If that is success case scenario, this fix will do the work, if it is
failure case scenario, appropriate return value should also needed to be 
err.

In any case, the commit message that I have mentioned will not be
correct, so please scratch that.

Kamlesh