public inbox for linux-fsdevel@vger.kernel.org
 help / color / mirror / Atom feed
From: David Howells <dhowells@redhat.com>
To: Christian Brauner <christian@brauner.io>
Cc: David Howells <dhowells@redhat.com>,
	Paulo Alcantara <pc@manguebit.org>,
	netfs@lists.linux.dev, linux-afs@lists.infradead.org,
	linux-cifs@vger.kernel.org, ceph-devel@vger.kernel.org,
	linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	Matthew Wilcox <willy@infradead.org>
Subject: [PATCH v3 12/19] netfs: Fix potential uninitialised var in netfs_extract_user_iter()
Date: Sat, 25 Apr 2026 13:54:16 +0100	[thread overview]
Message-ID: <20260425125426.3855807-13-dhowells@redhat.com> (raw)
In-Reply-To: <20260425125426.3855807-1-dhowells@redhat.com>

In netfs_extract_user_iter(), if it's given a zero-length iterator, it will
fall through the loop without setting ret, and so the error handling
behaviour will be undefined, depending on whether ret happens to be
negative.  The value of ret then propagates back up the callstack.

Fix this by presetting ret to 0.

Fixes: 85dd2c8ff368 ("netfs: Add a function to extract a UBUF or IOVEC into a BVEC iterator")
Closes: https://sashiko.dev/#/patchset/20260414082004.3756080-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Paulo Alcantara <pc@manguebit.org>
cc: Matthew Wilcox <willy@infradead.org>
cc: netfs@lists.linux.dev
cc: linux-fsdevel@vger.kernel.org
---
 fs/netfs/iterator.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/netfs/iterator.c b/fs/netfs/iterator.c
index adca78747f23..429e4396e1b0 100644
--- a/fs/netfs/iterator.c
+++ b/fs/netfs/iterator.c
@@ -43,7 +43,7 @@ ssize_t netfs_extract_user_iter(struct iov_iter *orig, size_t orig_len,
 	unsigned int max_pages;
 	unsigned int npages = 0;
 	unsigned int i;
-	ssize_t ret;
+	ssize_t ret = 0;
 	size_t count = orig_len, offset, len;
 	size_t bv_size, pg_size;
 


  parent reply	other threads:[~2026-04-25 12:55 UTC|newest]

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-04-25 12:54 [PATCH v3 00/19] netfs: Miscellaneous fixes David Howells
2026-04-25 12:54 ` [PATCH v3 01/19] netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call David Howells
2026-04-25 12:54 ` [PATCH v3 02/19] netfs: fix error handling in netfs_extract_user_iter() David Howells
2026-04-25 12:54 ` [PATCH v3 03/19] netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone David Howells
2026-04-25 12:54 ` [PATCH v3 04/19] netfs: Defer the emission of trace_netfs_folio() David Howells
2026-04-25 12:54 ` [PATCH v3 05/19] netfs: Fix streaming write being overwritten David Howells
2026-04-25 12:54 ` [PATCH v3 06/19] netfs: Fix read-gaps to remove netfs_folio from filled folio David Howells
2026-04-25 12:54 ` [PATCH v3 07/19] netfs: Fix zeropoint update where i_size > remote_i_size David Howells
2026-04-25 12:54 ` [PATCH v3 08/19] netfs: Fix write streaming disablement if fd open O_RDWR David Howells
2026-04-25 12:54 ` [PATCH v3 09/19] netfs: Fix early put of sink folio in netfs_read_gaps() David Howells
2026-04-25 12:54 ` [PATCH v3 10/19] netfs: Fix leak of request in netfs_write_begin() error handling David Howells
2026-04-25 12:54 ` [PATCH v3 11/19] netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() David Howells
2026-04-25 12:54 ` David Howells [this message]
2026-04-25 12:54 ` [PATCH v3 13/19] netfs: Fix partial invalidation of streaming-write folio David Howells
2026-04-25 12:54 ` [PATCH v3 14/19] netfs: Fix folio->private handling in netfs_perform_write() David Howells
2026-04-25 12:54 ` [PATCH v3 15/19] netfs: Fix potential for tearing in ->remote_i_size and ->zero_point David Howells
2026-04-25 12:54 ` [PATCH v3 16/19] netfs: Fix netfs_read_folio() to wait on writeback David Howells
2026-04-25 12:54 ` [PATCH v3 17/19] netfs: Fix missing barriers when accessing stream->subrequests locklessly David Howells
2026-04-25 12:54 ` [PATCH v3 18/19] afs: Fix afs_get_link() to take validate_lock around afs_read_single() David Howells
2026-04-25 12:54 ` [PATCH v3 19/19] afs: Fix RCU handling of symlinks in RCU pathwalk David Howells

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260425125426.3855807-13-dhowells@redhat.com \
    --to=dhowells@redhat.com \
    --cc=ceph-devel@vger.kernel.org \
    --cc=christian@brauner.io \
    --cc=linux-afs@lists.infradead.org \
    --cc=linux-cifs@vger.kernel.org \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netfs@lists.linux.dev \
    --cc=pc@manguebit.org \
    --cc=willy@infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox