[1/5] lightnvm: Fix uninitialized pointer in nvm_remove_tgt()
diff mbox series

Message ID 20190528142424.19626-2-geert@linux-m68k.org
State New, archived
Headers show
Series
  • Assorted fixes discovered with gcc 4.1
Related show

Commit Message

Geert Uytterhoeven May 28, 2019, 2:24 p.m. UTC
With gcc 4.1:

    drivers/lightnvm/core.c: In function ‘nvm_remove_tgt’:
    drivers/lightnvm/core.c:510: warning: ‘t’ is used uninitialized in this function

Indeed, if no NVM devices have been registered, t will be an
uninitialized pointer, and may be dereferenced later.  A call to
nvm_remove_tgt() can be triggered from userspace by issuing the
NVM_DEV_REMOVE ioctl on the lightnvm control device.

Fix this by preinitializing t to NULL.

Fixes: 843f2edbdde085b4 ("lightnvm: do not remove instance under global lock")
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
---
 drivers/lightnvm/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Matias Bjørling May 29, 2019, 8:08 a.m. UTC | #1
On 5/28/19 4:24 PM, Geert Uytterhoeven wrote:
> With gcc 4.1:
> 
>      drivers/lightnvm/core.c: In function ‘nvm_remove_tgt’:
>      drivers/lightnvm/core.c:510: warning: ‘t’ is used uninitialized in this function
> 
> Indeed, if no NVM devices have been registered, t will be an
> uninitialized pointer, and may be dereferenced later.  A call to
> nvm_remove_tgt() can be triggered from userspace by issuing the
> NVM_DEV_REMOVE ioctl on the lightnvm control device.
> 
> Fix this by preinitializing t to NULL.
> 
> Fixes: 843f2edbdde085b4 ("lightnvm: do not remove instance under global lock")
> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
> ---
>   drivers/lightnvm/core.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> index 0df7454832efe082..aa017f48eb8c588c 100644
> --- a/drivers/lightnvm/core.c
> +++ b/drivers/lightnvm/core.c
> @@ -492,7 +492,7 @@ static void __nvm_remove_target(struct nvm_target *t, bool graceful)
>    */
>   static int nvm_remove_tgt(struct nvm_ioctl_remove *remove)
>   {
> -	struct nvm_target *t;
> +	struct nvm_target *t = NULL;
>   	struct nvm_dev *dev;
>   
>   	down_read(&nvm_lock);
> 

Thanks Geert. Would you like me to carry the patch?
Geert Uytterhoeven May 29, 2019, 8:12 a.m. UTC | #2
Hi Matias,

On Wed, May 29, 2019 at 10:08 AM Matias Bjørling <mb@lightnvm.io> wrote:
> On 5/28/19 4:24 PM, Geert Uytterhoeven wrote:
> > With gcc 4.1:
> >
> >      drivers/lightnvm/core.c: In function ‘nvm_remove_tgt’:
> >      drivers/lightnvm/core.c:510: warning: ‘t’ is used uninitialized in this function
> >
> > Indeed, if no NVM devices have been registered, t will be an
> > uninitialized pointer, and may be dereferenced later.  A call to
> > nvm_remove_tgt() can be triggered from userspace by issuing the
> > NVM_DEV_REMOVE ioctl on the lightnvm control device.
> >
> > Fix this by preinitializing t to NULL.
> >
> > Fixes: 843f2edbdde085b4 ("lightnvm: do not remove instance under global lock")
> > Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
> > ---
> >   drivers/lightnvm/core.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
> > index 0df7454832efe082..aa017f48eb8c588c 100644
> > --- a/drivers/lightnvm/core.c
> > +++ b/drivers/lightnvm/core.c
> > @@ -492,7 +492,7 @@ static void __nvm_remove_target(struct nvm_target *t, bool graceful)
> >    */
> >   static int nvm_remove_tgt(struct nvm_ioctl_remove *remove)
> >   {
> > -     struct nvm_target *t;
> > +     struct nvm_target *t = NULL;
> >       struct nvm_dev *dev;
> >
> >       down_read(&nvm_lock);
> >
>
> Thanks Geert. Would you like me to carry the patch?

Yes please. Thanks!

Gr{oetje,eeting}s,

                        Geert

Patch
diff mbox series

diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c
index 0df7454832efe082..aa017f48eb8c588c 100644
--- a/drivers/lightnvm/core.c
+++ b/drivers/lightnvm/core.c
@@ -492,7 +492,7 @@  static void __nvm_remove_target(struct nvm_target *t, bool graceful)
  */
 static int nvm_remove_tgt(struct nvm_ioctl_remove *remove)
 {
-	struct nvm_target *t;
+	struct nvm_target *t = NULL;
 	struct nvm_dev *dev;
 
 	down_read(&nvm_lock);