Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1457680 > unrolled thread

[PATCH] [net] rxrpc: fix uninitialized pointer dereference in debug code

Back to article view | Back to linux.kernel

Contents

  [PATCH] [net] rxrpc: fix uninitialized pointer dereference in debug code Arnd Bergmann <arnd@arndb.de> - 2016-08-08 12:20 +0200
    Re: [PATCH] [net] rxrpc: fix uninitialized pointer dereference in debug code David Howells <dhowells@redhat.com> - 2016-08-08 14:50 +0200

#1457680 — [PATCH] [net] rxrpc: fix uninitialized pointer dereference in debug code

A newly added bugfix caused an uninitialized variable to be
used for printing debug output. This is harmless as long
as the debug setting is disabled, but otherwise leads to an
immediate crash.

gcc warns about this when -Wmaybe-uninitialized is enabled:

net/rxrpc/call_object.c: In function 'rxrpc_release_call':
net/rxrpc/call_object.c:496:163: error: 'sp' may be used uninitialized in this function [-Werror=maybe-uninitialized]

The initialization was removed but one of the users remains.
This adds back the initialization.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 372ee16386bb ("rxrpc: Fix races between skb free, ACK generation and replying")
---
I have not tried to understand the longish bugfix patch that
caused this, so I'm not sure whether it's actually safe to
access rxrpc_skb(skb) in this function. Please check if this
is the right fix.
---
 net/rxrpc/call_object.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index c47f14fc5e88..e8c953c48cb8 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -493,6 +493,7 @@ void rxrpc_release_call(struct rxrpc_call *call)
 		       (skb = skb_dequeue(&call->rx_oos_queue))) {
 			spin_unlock_bh(&call->lock);
 
+			sp = rxrpc_skb(skb);
 			_debug("- zap %s %%%u #%u",
 			       rxrpc_pkts[sp->hdr.type],
 			       sp->hdr.serial, sp->hdr.seq);
-- 
2.9.0

[toc] | [next] | [standalone]

#1457759

Arnd Bergmann <arnd@arndb.de> wrote:

> A newly added bugfix caused an uninitialized variable to be
> used for printing debug output. This is harmless as long
> as the debug setting is disabled, but otherwise leads to an
> immediate crash.
> 
> gcc warns about this when -Wmaybe-uninitialized is enabled:
> 
> net/rxrpc/call_object.c: In function 'rxrpc_release_call':
> net/rxrpc/call_object.c:496:163: error: 'sp' may be used uninitialized in this function [-Werror=maybe-uninitialized]
> 
> The initialization was removed but one of the users remains.
> This adds back the initialization.
> 
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> Fixes: 372ee16386bb ("rxrpc: Fix races between skb free, ACK generation and replying")

Applied, thanks.

David

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web