archive mirror
 help / color / mirror / Atom feed
From: Arnd Bergmann <>
To: Tom Herbert <>
Cc: Jiri Pirko <>,
	"David S. Miller" <>,
	Alexander Duyck <>,
	Jiri Pirko <>,
	Hadar Hen Zion <>,
	Gao Feng <>,
	Amir Vadai <>,
	Linux Kernel Network Developers <>,
	LKML <>,
	Linus Torvalds <>
Subject: [PATCH net-next] flow_dissector: fix vlan tag handling
Date: Sat, 22 Oct 2016 22:30:08 +0200	[thread overview]
Message-ID: <3590200.oN5tv3ZPpc@wuerfel> (raw)
In-Reply-To: <>

gcc warns about an uninitialized pointer dereference in the vlan
priority handling:

net/core/flow_dissector.c: In function '__skb_flow_dissect':
net/core/flow_dissector.c:281:61: error: 'vlan' may be used uninitialized in this function [-Werror=maybe-uninitialized]

As pointed out by Jiri Pirko, the variable is never actually used
without being initialized first as the only way it end up uninitialized
is with skb_vlan_tag_present(skb)==true, and that means it does not
get accessed.

However, the warning hints at some related issues that I'm addressing

- the second check for the vlan tag is different from the first one
  that tests the skb for being NULL first, causing both the warning
  and a possible NULL pointer dereference that was not entirely fixed.
- The same patch that introduced the NULL pointer check dropped an
  earlier optimization that skipped the repeated check of the
  protocol type
- The local '_vlan' variable is referenced through the 'vlan' pointer
  but the variable has gone out of scope by the time that it is
  accessed, causing undefined behavior as the stack may have been

Caching the result of the 'skb && skb_vlan_tag_present(skb)' check
in a local variable allows the compiler to further optimize the
later check. With those changes, the warning also disappears.

Fixes: 3805a938a6c2 ("flow_dissector: Check skb for VLAN only if skb specified.")
Signed-off-by: Arnd Bergmann <>

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 44e6ba9d3a6b..17be1b66cc41 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -246,13 +246,10 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
 	case htons(ETH_P_8021AD):
 	case htons(ETH_P_8021Q): {
 		const struct vlan_hdr *vlan;
+		struct vlan_hdr _vlan;
+		bool vlan_tag_present = (skb && skb_vlan_tag_present(skb));
-		if (skb && skb_vlan_tag_present(skb))
-			proto = skb->protocol;
-		if (eth_type_vlan(proto)) {
-			struct vlan_hdr _vlan;
+		if (!vlan_tag_present || eth_type_vlan(skb->protocol)) {
 			vlan = __skb_header_pointer(skb, nhoff, sizeof(_vlan),
 						    data, hlen, &_vlan);
 			if (!vlan)
@@ -270,7 +267,7 @@ bool __skb_flow_dissect(const struct sk_buff *skb,
-			if (skb_vlan_tag_present(skb)) {
+			if (vlan_tag_present) {
 				key_vlan->vlan_id = skb_vlan_tag_get_id(skb);
 				key_vlan->vlan_priority =
 					(skb_vlan_tag_get_prio(skb) >> VLAN_PRIO_SHIFT);

  reply	other threads:[~2016-10-23 19:52 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-10-21 15:55 [PATCH] flow_dissector: avoid uninitialized variable access Arnd Bergmann
2016-10-21 16:31 ` Jiri Pirko
2016-10-21 21:05   ` Arnd Bergmann
2016-10-21 22:16     ` Arnd Bergmann
2016-10-22 15:57       ` Eric Garver
2016-10-22 18:20         ` Tom Herbert
2016-10-22 20:30           ` Arnd Bergmann [this message]
2016-10-24  8:17             ` [PATCH net-next] flow_dissector: fix vlan tag handling Jiri Pirko
2016-10-24 16:00               ` Arnd Bergmann
2016-10-22  1:48   ` [PATCH] flow_dissector: avoid uninitialized variable access Linus Torvalds
2016-10-22  6:55     ` Jiri Pirko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=3590200.oN5tv3ZPpc@wuerfel \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).