Re: [PATCH][4.15] gnttab: work around "may be used uninitialized" warning

[Jan Beulich <jbeulich@suse.com>]

On 10.03.2021 15:58, Julien Grall wrote:
> On 10/03/2021 10:13, Jan Beulich wrote:
>> Sadly I was wrong to suggest dropping vaddrs' initializer during review
>> of v2 of the patch introducing this code. gcc 4.3 can't cope.
> 
> What's the error?

The one quoted in the title.

> Are you sure this is not going to hiding a potential 
> miscompilation of the function?

Miscompilation? It may hide us screwing up, but addressing such a
compiler warning by adding an initializer has been quite common
in the past.

>> --- a/xen/common/grant_table.c
>> +++ b/xen/common/grant_table.c
>> @@ -4026,7 +4026,7 @@ int gnttab_acquire_resource(
>>       struct grant_table *gt = d->grant_table;
>>       unsigned int i, final_frame;
>>       mfn_t tmp;
>> -    void **vaddrs;
>> +    void **vaddrs = NULL;
> I am a bit nervous to inialize vaddrs to NULL for a few reasons:
>    1) It is not 100% obvious (e.g. it takes more than a second) that 
> vaddrs will always be initialized.

But convincing ourselves was necessary even more so prior to this
change. We must not ever rely on the compiler to tell us about
issues in our code. We can only leverage that in some cases it
does. From this it (I think obviously) follows that without the
initializer we're at bigger risk than with it.

>    2) A compiler will not be able to help us if we are adding code 
> without initialized vaddrs.
> 
> It also feels wrong to me to try to write Xen in a way that will make a 
> 10 years compiler happy...

As said above - we've worked around limitations quite a few times
in the past. This is just one more instance.

> If we still want to support them, then maybe a better approach would be 
> to turn off to turn off -Werror for some version of GCC. So we can 
> continue to benefit from the newer compiler diagnostics.

Avoiding use of -Werror is not an option imo: Once you start seeing
warnings, you have only two options imo: Either one decides to ignore
them all (and then one will also ignore new ones introduce by changes
yet to be submitted), or one would have to memorize, for every build
one does, which warnings one ought to ignore. The latter doesn't
scale, while the former is a code quality problem.

Suppressing a particular class of warning might be an option, but
again risks somebody submitting code which elsewhere would trigger
warnings.

Jan