[PATCH] io_uring: Initialize variable before use

[PATCH] io_uring: Initialize variable before use

[Muhammad Usama Anjum]

1) Initialize the struct msghdr msg in the start of the function
2) Uninitialized variable msg.msg_flags can get used if branch happens to
out_free before initialization.

So initialize variable in question in the start of the function for
simplicity in logic and use.

Addresses-Coverity: ("Uninitialized variable")
Addresses-Coverity: ("Uninitialized variable read")
Signed-off-by: Muhammad Usama Anjum <musamaanjum@gmail.com>
---
 fs/io_uring.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index bba74631954b..d5f83326abff 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4677,7 +4677,8 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 {
 	struct io_buffer *kbuf;
 	struct io_sr_msg *sr = &req->sr_msg;
-	struct msghdr msg;
+	struct msghdr msg = {.msg_name = NULL, .msg_control = NULL, .msg_controllen = 0,
+			     .msg_namelen = 0, .msg_iocb = NULL, .msg_flags = 0};
 	void __user *buf = sr->buf;
 	struct socket *sock;
 	struct iovec iov;
@@ -4701,13 +4702,6 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 	if (unlikely(ret))
 		goto out_free;
 
-	msg.msg_name = NULL;
-	msg.msg_control = NULL;
-	msg.msg_controllen = 0;
-	msg.msg_namelen = 0;
-	msg.msg_iocb = NULL;
-	msg.msg_flags = 0;
-
 	flags = req->sr_msg.msg_flags | MSG_NOSIGNAL;
 	if (flags & MSG_DONTWAIT)
 		req->flags |= REQ_F_NOWAIT;
-- 
2.25.1

Re: [PATCH] io_uring: Initialize variable before use

[Muhammad Usama Anjum]

On Mon, 2021-03-22 at 23:41 +0500, Muhammad Usama Anjum wrote:
> 1) Initialize the struct msghdr msg in the start of the function
> 2) Uninitialized variable msg.msg_flags can get used if branch happens to
> out_free before initialization.
> 
> So initialize variable in question in the start of the function for
> simplicity in logic and use.
> 
> Addresses-Coverity: ("Uninitialized variable")
> Addresses-Coverity: ("Uninitialized variable read")
> Signed-off-by: Muhammad Usama Anjum <musamaanjum@gmail.com>
> ---
>  fs/io_uring.c | 10 ++--------
>  1 file changed, 2 insertions(+), 8 deletions(-)
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index bba74631954b..d5f83326abff 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -4677,7 +4677,8 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
>  {
>  	struct io_buffer *kbuf;
>  	struct io_sr_msg *sr = &req->sr_msg;
> -	struct msghdr msg;
> +	struct msghdr msg = {.msg_name = NULL, .msg_control = NULL, .msg_controllen = 0,
> +			     .msg_namelen = 0, .msg_iocb = NULL, .msg_flags = 0};
>  	void __user *buf = sr->buf;
>  	struct socket *sock;
>  	struct iovec iov;
> @@ -4701,13 +4702,6 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
>  	if (unlikely(ret))
>  		goto out_free;
>  
> -	msg.msg_name = NULL;
> -	msg.msg_control = NULL;
> -	msg.msg_controllen = 0;
> -	msg.msg_namelen = 0;
> -	msg.msg_iocb = NULL;
> -	msg.msg_flags = 0;
> -
>  	flags = req->sr_msg.msg_flags | MSG_NOSIGNAL;
>  	if (flags & MSG_DONTWAIT)
>  		req->flags |= REQ_F_NOWAIT;

Reminder. Does anybody has any comments on it?

Re: [PATCH] io_uring: Initialize variable before use

[Dan Carpenter]

On Mon, Mar 22, 2021 at 11:41:58PM +0500, Muhammad Usama Anjum wrote:
> 1) Initialize the struct msghdr msg in the start of the function
> 2) Uninitialized variable msg.msg_flags can get used if branch happens to
> out_free before initialization.
> 
> So initialize variable in question in the start of the function for
> simplicity in logic and use.
> 
> Addresses-Coverity: ("Uninitialized variable")
> Addresses-Coverity: ("Uninitialized variable read")

This bug is a false positive.

When msg.msg_flags is uninitialized then ret is negative and min_ret is
zero.

fs/io_uring.c
  4666                  ret = -EINTR;
  4667  out_free:
  4668          if (req->flags & REQ_F_BUFFER_SELECTED)
  4669                  cflags = io_put_recv_kbuf(req);
  4670          if (ret < min_ret || ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))))
                    ^^^^^^^^^^^^^                               ^^^^^^^^^^^^^
The first part of the condition is true so the second part is not used.

  4671                  req_set_fail_links(req);
  4672          __io_req_complete(req, issue_flags, ret, cflags);
  4673          return 0;
  4674  }

regards,
dan carpenter

Re: [PATCH] io_uring: Initialize variable before use

[Muhammad Usama Anjum]

On Wed, 2021-03-31 at 11:48 +0300, Dan Carpenter wrote:
> On Mon, Mar 22, 2021 at 11:41:58PM +0500, Muhammad Usama Anjum wrote:
> > 1) Initialize the struct msghdr msg in the start of the function
> > 2) Uninitialized variable msg.msg_flags can get used if branch happens to
> > out_free before initialization.
> > 
> > So initialize variable in question in the start of the function for
> > simplicity in logic and use.
> > 
> > Addresses-Coverity: ("Uninitialized variable")
> > Addresses-Coverity: ("Uninitialized variable read")
> 
> This bug is a false positive.
> 
> When msg.msg_flags is uninitialized then ret is negative and min_ret is
> zero.
> 
> fs/io_uring.c
>   4666                  ret = -EINTR;
>   4667  out_free:
>   4668          if (req->flags & REQ_F_BUFFER_SELECTED)
>   4669                  cflags = io_put_recv_kbuf(req);
>   4670          if (ret < min_ret || ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))))
>                     ^^^^^^^^^^^^^                               ^^^^^^^^^^^^^
> The first part of the condition is true so the second part is not used.
> 
>   4671                  req_set_fail_links(req);
>   4672          __io_req_complete(req, issue_flags, ret, cflags);
>   4673          return 0;
>   4674  }
> 
Understood. Thank you so much!

Thanks,
Usama

> regards,
> dan carpenter
>