linux-kernel - Re: [PATCH v3] block: Fix uninitialized symbol 'bio' in blk_rq_prep

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZwVHF_0Z0dNnYW58@kbusch-mbp>
Date: Tue, 8 Oct 2024 08:52:07 -0600
From: Keith Busch <kbusch@...nel.org>
To: SurajSonawane2415 <surajsonawane0215@...il.com>
Cc: axboe@...nel.dk, linux-block@...r.kernel.org,
	linux-kernel@...r.kernel.org, hch@...radead.org
Subject: Re: [PATCH v3] block: Fix uninitialized symbol 'bio' in
 blk_rq_prep_clone

On Tue, Oct 08, 2024 at 05:34:13PM +0530, SurajSonawane2415 wrote:
> Fix the uninitialized symbol 'bio' in the function blk_rq_prep_clone
> to resolve the following error:
> block/blk-mq.c:3199 blk_rq_prep_clone() error: uninitialized symbol 'bio'.

...

> @@ -3156,19 +3156,21 @@ int blk_rq_prep_clone(struct request *rq, struct request *rq_src,
>  		      int (*bio_ctr)(struct bio *, struct bio *, void *),
>  		      void *data)
>  {
> -	struct bio *bio, *bio_src;
> +	struct bio *bio_src;
>  
>  	if (!bs)
>  		bs = &fs_bio_set;
>  
>  	__rq_for_each_bio(bio_src, rq_src) {
> -		bio = bio_alloc_clone(rq->q->disk->part0, bio_src, gfp_mask,
> +		struct bio *bio = bio_alloc_clone(rq->q->disk->part0, bio_src, gfp_mask,
>  				      bs);
>  		if (!bio)
>  			goto free_and_out;
>  
> -		if (bio_ctr && bio_ctr(bio, bio_src, data))
> +		if (bio_ctr && bio_ctr(bio, bio_src, data)) {
> +			bio_put(bio);
>  			goto free_and_out;
> +		}
>  
>  		if (rq->bio) {
>  			rq->biotail->bi_next = bio;
> @@ -3176,7 +3178,6 @@ int blk_rq_prep_clone(struct request *rq, struct request *rq_src,
>  		} else {
>  			rq->bio = rq->biotail = bio;
>  		}
> -		bio = NULL;
>  	}
>  
>  	/* Copy attributes of the original request to the clone request. */
> @@ -3196,8 +3197,6 @@ int blk_rq_prep_clone(struct request *rq, struct request *rq_src,
>  	return 0;
>  
>  free_and_out:
> -	if (bio)
> -		bio_put(bio);
>  	blk_rq_unprep_clone(rq);

I think your commit message is missing the real "fix" here. The other
place that goto's this label is if blk_crypto_rq_bio_prep() fails. At
this point, the cloned 'rq' has all the bio's that get cleaned up in
blk_rq_unprep_clone(), so that failure scenario is double put'ing the
last bio.