+ squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors.patch added to -mm tree

+ squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors.patch added to -mm tree

[akpm]

The patch titled
     squashfs: fix use of uninitialised variable in zlib & xz decompressors
has been added to the -mm tree.  Its filename is
     squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/SubmitChecklist when testing your code ***

See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find
out what to do about this

The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/

------------------------------------------------------
Subject: squashfs: fix use of uninitialised variable in zlib & xz decompressors
From: Phillip Lougher <phillip@lougher.demon.co.uk>

Fix potential use of uninitialised variable caused by recent decompressor
code optimisations.

In zlib_uncompress (zlib_wrapper.c) we have

	int zlib_err, zlib_init = 0;
	...
	do {
		...
			if (avail == 0) {
				offset = 0;
				put_bh(bh[k++]);
				continue;
			}
		...
		zlib_err = zlib_inflate(stream, Z_SYNC_FLUSH);
		...
	} while (zlib_err == Z_OK);

If continue is executed (avail == 0) then the while condition will be
evaluated testing zlib_err, which is uninitialised first time around the
loop.

Fix this by getting rid of the 'if (avail == 0)' condition test, this edge
condition should not be being handled in the decompressor code, and
instead handle it generically in the caller code.

Similarly for xz_wrapper.c.

Incidentally, on most architectures (bar Mips and Parisc), no
uninitialised variable warning is generated by gcc, this is because the
while condition test on continue is optimised out and not performed (when
executing continue zlib_err has not been changed since entering the loop,
and logically if the while condition was true previously, then it's still
true).

Signed-off-by: Phillip Lougher <phillip@lougher.demon.co.uk>
Reported-by: Jesper Juhl <jj@chaosbits.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/squashfs/block.c        |    8 ++++++++
 fs/squashfs/xz_wrapper.c   |    6 ------
 fs/squashfs/zlib_wrapper.c |    6 ------
 3 files changed, 8 insertions(+), 12 deletions(-)

diff -puN fs/squashfs/block.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors fs/squashfs/block.c
--- a/fs/squashfs/block.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors
+++ a/fs/squashfs/block.c
@@ -63,6 +63,14 @@ static struct buffer_head *get_block_len
 		*length = (unsigned char) bh->b_data[*offset] |
 			(unsigned char) bh->b_data[*offset + 1] << 8;
 		*offset += 2;
+
+		if (*offset == msblk->devblksize) {
+			put_bh(bh);
+			bh = sb_bread(sb, ++(*cur_index));
+			if (bh == NULL)
+				return NULL;
+			*offset = 0;
+		}
 	}
 
 	return bh;
diff -puN fs/squashfs/xz_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors fs/squashfs/xz_wrapper.c
--- a/fs/squashfs/xz_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors
+++ a/fs/squashfs/xz_wrapper.c
@@ -95,12 +95,6 @@ static int squashfs_xz_uncompress(struct
 			if (!buffer_uptodate(bh[k]))
 				goto release_mutex;
 
-			if (avail == 0) {
-				offset = 0;
-				put_bh(bh[k++]);
-				continue;
-			}
-
 			stream->buf.in = bh[k]->b_data + offset;
 			stream->buf.in_size = avail;
 			stream->buf.in_pos = 0;
diff -puN fs/squashfs/zlib_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors fs/squashfs/zlib_wrapper.c
--- a/fs/squashfs/zlib_wrapper.c~squashfs-fix-use-of-uninitialised-variable-in-zlib-xz-decompressors
+++ a/fs/squashfs/zlib_wrapper.c
@@ -82,12 +82,6 @@ static int zlib_uncompress(struct squash
 			if (!buffer_uptodate(bh[k]))
 				goto release_mutex;
 
-			if (avail == 0) {
-				offset = 0;
-				put_bh(bh[k++]);
-				continue;
-			}