From: Eric Dumazet <edumazet@google.com>
To: Arnd Bergmann <arnd@arndb.de>
Cc: "David S. Miller" <davem@davemloft.net>,
Roopa Prabhu <roopa@cumulusnetworks.com>,
Nicolas Dichtel <nicolas.dichtel@6wind.com>,
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>,
Jiri Pirko <jiri@mellanox.com>,
Brenden Blanco <bblanco@plumgrid.com>,
Hannes Frederic Sowa <hannes@stressinduktion.org>,
Nogah Frankel <nogahf@mellanox.com>,
netdev <netdev@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] net: rtnl: avoid uninitialized data in IFLA_VF_VLAN_LIST handling
Date: Fri, 30 Sep 2016 09:23:55 -0700 [thread overview]
Message-ID: <CANn89iK2FQufz4NCan1y0dQME2RUOzc3NXXhqYd418ctHNc6fA@mail.gmail.com> (raw)
In-Reply-To: <20160930161416.18660-1-arnd@arndb.de>
On Fri, Sep 30, 2016 at 9:13 AM, Arnd Bergmann <arnd@arndb.de> wrote:
> With the newly added support for IFLA_VF_VLAN_LIST netlink messages,
> we get a warning about potential uninitialized variable use in
> the parsing of the user input when enabling the -Wmaybe-uninitialized
> warning:
>
> net/core/rtnetlink.c: In function 'do_setvfinfo':
> net/core/rtnetlink.c:1756:9: error: 'ivvl$' may be used uninitialized in this function [-Werror=maybe-uninitialized]
>
> I have not been able to prove whether it is possible to arrive in
> this code with an empty IFLA_VF_VLAN_LIST block, but if we do,
> then ndo_set_vf_vlan gets called with uninitialized arguments.
>
> This adds an explicit check for an empty list, making it obvious
> to the reader and the compiler that this cannot happen.
>
> Fixes: 79aab093a0b5 ("net: Update API for VF vlan protocol 802.1ad support")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
> ---
> net/core/rtnetlink.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index 3ac8946bf244..b06d2f46b83e 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -1753,6 +1753,9 @@ static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
>
> len++;
> }
> + if (len == 0)
> + return -EINVAL;
> +
> err = ops->ndo_set_vf_vlan(dev, ivvl[0]->vf, ivvl[0]->vlan,
> ivvl[0]->qos, ivvl[0]->vlan_proto);
> if (err < 0)
> --
> 2.9.0
>
So, if I read this code, we build an array, but call ndo_set_vf_vlan()
only using first element ?
Looks like the bug should be fixed in a different way.
next prev parent reply other threads:[~2016-09-30 16:24 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-09-30 16:13 [PATCH] net: rtnl: avoid uninitialized data in IFLA_VF_VLAN_LIST handling Arnd Bergmann
2016-09-30 16:23 ` Eric Dumazet [this message]
2016-09-30 16:38 ` Arnd Bergmann
2016-10-02 9:03 ` Tariq Toukan
2016-09-30 20:12 ` Or Gerlitz
2016-10-03 5:32 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CANn89iK2FQufz4NCan1y0dQME2RUOzc3NXXhqYd418ctHNc6fA@mail.gmail.com \
--to=edumazet@google.com \
--cc=arnd@arndb.de \
--cc=bblanco@plumgrid.com \
--cc=davem@davemloft.net \
--cc=hannes@stressinduktion.org \
--cc=jiri@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nicolas.dichtel@6wind.com \
--cc=nikolay@cumulusnetworks.com \
--cc=nogahf@mellanox.com \
--cc=roopa@cumulusnetworks.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).