linux-kernel - [PATCH 1/1] Drivers: hv: Fix uninit'ed variable in hv_msg_dump() if CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251219160832.1628-1-mhklinux@outlook.com>
Date: Fri, 19 Dec 2025 08:08:32 -0800
From: mhkelley58@...il.com
To: haiyangz@...rosoft.com,
	wei.liu@...nel.org,
	decui@...rosoft.com,
	kys@...rosoft.com,
	linux-kernel@...r.kernel.org,
	linux-hyperv@...r.kernel.org,
	dan.carpenter@...aro.org
Subject: [PATCH 1/1] Drivers: hv: Fix uninit'ed variable in hv_msg_dump() if CONFIG_PRINTK not set

From: Michael Kelley <mhklinux@...look.com>

When CONFIG_PRINTK is not set, kmsg_dump_get_buffer() returns 'false'
without setting the bytes_written argument. In such case, bytes_written
is uninitialized when it is tested for zero.

This is admittedly an unlikely scenario, but in the interest of correctness
and avoiding tool noise about uninitialized variables, fix this by testing
the return value before testing bytes_written.

Fixes: 9c318a1d9b50 ("Drivers: hv: move panic report code from vmbus to hv early init code")
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
Closes: https://lore.kernel.org/all/202512172102.OcUspn1Z-lkp@intel.com/
Signed-off-by: Michael Kelley <mhklinux@...look.com>
---
 drivers/hv/hv_common.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/hv/hv_common.c b/drivers/hv/hv_common.c
index f466a6099eff..de9e069c5a0c 100644
--- a/drivers/hv/hv_common.c
+++ b/drivers/hv/hv_common.c
@@ -188,6 +188,7 @@ static void hv_kmsg_dump(struct kmsg_dumper *dumper,
 {
 	struct kmsg_dump_iter iter;
 	size_t bytes_written;
+	bool ret;
 
 	/* We are only interested in panics. */
 	if (detail->reason != KMSG_DUMP_PANIC || !sysctl_record_panic_msg)
@@ -198,9 +199,9 @@ static void hv_kmsg_dump(struct kmsg_dumper *dumper,
 	 * be single-threaded.
 	 */
 	kmsg_dump_rewind(&iter);
-	kmsg_dump_get_buffer(&iter, false, hv_panic_page, HV_HYP_PAGE_SIZE,
-			     &bytes_written);
-	if (!bytes_written)
+	ret = kmsg_dump_get_buffer(&iter, false, hv_panic_page, HV_HYP_PAGE_SIZE,
+				   &bytes_written);
+	if (!ret || !bytes_written)
 		return;
 	/*
 	 * P3 to contain the physical address of the panic page & P4 to
-- 
2.25.1