All of lore.kernel.org
 help / color / mirror / Atom feed
From: coverity-bot <keescook@chromium.org>
To: Oleg Nesterov <oleg@redhat.com>, Christian Brauner <brauner@kernel.org>
Cc: Nicholas Piggin <npiggin@gmail.com>,
	Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
	Peng Zhang <zhangpeng.00@bytedance.com>,
	Oleg Nesterov <oleg@redhat.com>, Ard Biesheuvel <ardb@kernel.org>,
	Luis Chamberlain <mcgrof@kernel.org>,
	Christian Brauner <brauner@kernel.org>,
	Heiko Carstens <hca@linux.ibm.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	Suren Baghdasaryan <surenb@google.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Mateusz Guzik <mjguzik@gmail.com>,
	Dmitry Vyukov <dvyukov@google.com>,
	Tycho Andersen <tycho@tycho.pizza>,
	Tycho Andersen <tandersen@netflix.com>,
	Mike Christie <michael.christie@oracle.com>,
	"Paul E. McKenney" <paulmck@kernel.org>,
	linux-kernel@vger.kernel.org,
	"Gustavo A. R. Silva" <gustavo@embeddedor.com>,
	linux-next@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Coverity: __do_sys_pidfd_send_signal(): UNINIT
Date: Tue, 13 Feb 2024 15:59:37 -0800	[thread overview]
Message-ID: <202402131559.B76A34B@keescook> (raw)

Hello!

This is an experimental semi-automated report about issues detected by
Coverity from a scan of next-20240213 as part of the linux-next scan project:
https://scan.coverity.com/projects/linux-next-weekly-scan

You're getting this email because you were associated with the identified
lines of code (noted below) that were touched by commits:

  Sat Feb 10 22:37:25 2024 +0100
    3f643cd23510 ("pidfd: allow to override signal scope in pidfd_send_signal()")
  Sat Feb 10 22:37:23 2024 +0100
    81b9d8ac0640 ("pidfd: change pidfd_send_signal() to respect PIDFD_THREAD")

Coverity reported the following:

*** CID 1583637:    (UNINIT)
kernel/signal.c:3963 in __do_sys_pidfd_send_signal()
3957     		/* Only allow sending arbitrary signals to yourself. */
3958     		ret = -EPERM;
3959     		if ((task_pid(current) != pid) &&
3960     		    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
3961     			goto err;
3962     	} else {
vvv     CID 1583637:    (UNINIT)
vvv     Using uninitialized value "type" when calling "prepare_kill_siginfo".
3963     		prepare_kill_siginfo(sig, &kinfo, type);
3964     	}
3965
3966     	if (type == PIDTYPE_PGID)
3967     		ret = kill_pgrp_info(sig, &kinfo, pid);
3968     	else
kernel/signal.c:3966 in __do_sys_pidfd_send_signal()
3960     		    (kinfo.si_code >= 0 || kinfo.si_code == SI_TKILL))
3961     			goto err;
3962     	} else {
3963     		prepare_kill_siginfo(sig, &kinfo, type);
3964     	}
3965
vvv     CID 1583637:    (UNINIT)
vvv     Using uninitialized value "type".
3966     	if (type == PIDTYPE_PGID)
3967     		ret = kill_pgrp_info(sig, &kinfo, pid);
3968     	else
3969     		ret = kill_pid_info_type(sig, &kinfo, pid, type);
3970     err:
3971     	fdput(f);

If this is a false positive, please let us know so we can mark it as
such, or teach the Coverity rules to be smarter. If not, please make
sure fixes get into linux-next. :) For patches fixing this, please
include these lines (but double-check the "Fixes" first):

Reported-by: coverity-bot <keescook+coverity-bot@chromium.org>
Addresses-Coverity-ID: 1583637 ("UNINIT")
Fixes: 3f643cd23510 ("pidfd: allow to override signal scope in pidfd_send_signal()")
Fixes: 81b9d8ac0640 ("pidfd: change pidfd_send_signal() to respect PIDFD_THREAD")

Thanks for your attention!

(Human note: looks like a default case is needed in the switch
statement.)

-- 
Coverity-bot

             reply	other threads:[~2024-02-13 23:59 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-02-13 23:59 coverity-bot [this message]
2024-02-14  0:18 ` Coverity: __do_sys_pidfd_send_signal(): UNINIT Tycho Andersen
2024-02-14  9:03   ` Oleg Nesterov
2024-02-14  9:06     ` Oleg Nesterov
2024-02-14 14:18       ` Tycho Andersen
2024-02-14 17:55         ` Oleg Nesterov
2024-02-14 18:11           ` Tycho Andersen
2024-02-14 19:18             ` Oleg Nesterov
2024-02-16 12:37               ` Christian Brauner
2024-02-14 18:51   ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202402131559.B76A34B@keescook \
    --to=keescook@chromium.org \
    --cc=akpm@linux-foundation.org \
    --cc=ardb@kernel.org \
    --cc=bigeasy@linutronix.de \
    --cc=brauner@kernel.org \
    --cc=dvyukov@google.com \
    --cc=gustavo@embeddedor.com \
    --cc=hca@linux.ibm.com \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-next@vger.kernel.org \
    --cc=mcgrof@kernel.org \
    --cc=michael.christie@oracle.com \
    --cc=mjguzik@gmail.com \
    --cc=npiggin@gmail.com \
    --cc=oleg@redhat.com \
    --cc=paulmck@kernel.org \
    --cc=surenb@google.com \
    --cc=tandersen@netflix.com \
    --cc=tglx@linutronix.de \
    --cc=tycho@tycho.pizza \
    --cc=zhangpeng.00@bytedance.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.