[LSF/MM/BPF TOPIC] Uninitialized Variable In BPF Programs

[Yonghong Song <yonghong.song@linux.dev>]

If bpf program has an uninitialized variable, clang compiler
may take advantage of it to do some optimization. The resulted
bpf program may still survive verification but get wrong result.
Users then may take quite some time to understand the real
reason by inspecting asm codes.

The compiler flags '-Wall -Werror' are supposed to issue errors
if an uninitialized variable impacts the final result. But in
reality, since compiler may not be 100% sure a variable is
uninitalized due to limited analysis, the error may not be emitted.
gcc has '-Wmaybe-uninitialized' flag to issue warnings for some
possible uninit variables but still may miss some others.
clang does not support '-Wmaybe-uninitialized' flag.

There are already some discussion in llvm community for this ([1]).
I would like to elaborate more with some examples, e.g. how llvm
internal handle uninit variables, and discuss how we could do
something to expose harmful uninit variable earlier.

   [1] https://discourse.llvm.org/t/detect-undefined-behavior-due-to-uninitialized-variables-in-bpf-programs/84116?u=yonghong-song