From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C593C433DB for ; Tue, 5 Jan 2021 13:53:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CFFB422AAE for ; Tue, 5 Jan 2021 13:53:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728557AbhAENxm (ORCPT ); Tue, 5 Jan 2021 08:53:42 -0500 Received: from mail.kernel.org ([198.145.29.99]:40490 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726059AbhAENxl (ORCPT ); Tue, 5 Jan 2021 08:53:41 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id D9CF0229C4; Tue, 5 Jan 2021 13:52:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1609854781; bh=X3pkoKN+qZs+mrVkpCsjBnon/jYeQ9iVsUlzY0JchE0=; h=From:To:Cc:Subject:Date:From; b=BlZBfPQ4Siw1jwxbe/wPWPiSSEJxUF3SXt84aA5z9inaso4kkuG7OEQDCtYsw7lKm 1PjfAP5VUvMlBOgXCD9PqOhCCkcmxW9Yg5BHkPYTfWUriyUw5SLXO3Q2CYNNo5LYri MBEsKQL2xJPc5EW/Y0J7BADBxZSgHZzyyKnqmP+XN6PdQEgqk4ldNQ9wEc+/bwkg6c X6Abz3LCCt+ZcR8JoM7dBOON+j+9skX8beNN6KuGWQ1kXyjXDDQ8LLYJH/v96+hjs6 d9YMhcuSbSwDQh2Br2pRDOnC4Fe7/DQejWVr2YCffo+7Q53CTFzQlyxdQ8/ecv4z42 bilBSCE2aKDCw== From: Arnd Bergmann To: Nicolas Saenz Julienne , Greg Kroah-Hartman Cc: Arnd Bergmann , kernel test robot , Dan Carpenter , Marcelo Diop-Gonzalez , Amarjargal Gundjalam , bcm-kernel-feedback-list@broadcom.com, linux-rpi-kernel@lists.infradead.org, linux-arm-kernel@lists.infradead.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: [PATCH] staging: vchiq: fix uninitialized variable copy Date: Tue, 5 Jan 2021 14:52:45 +0100 Message-Id: <20210105135256.1810337-1-arnd@kernel.org> X-Mailer: git-send-email 2.29.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Arnd Bergmann Smatch found a local variable that can get copied to another local variable without an initializion in the error case: drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c:1056 vchiq_get_user_ptr() error: uninitialized symbol 'ptr'. This seems harmless, as the function should normally get inlined, with the output directly written or not. In any case, the uninitialized data is never used after get_user() fails. As Dan mentions, it could still trigger an UBSAN runtime error, and it is of course a bad idea to copy uninitialized variables, so just bail out early. Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Arnd Bergmann --- .../vc04_services/interface/vchiq_arm/vchiq_arm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c index f500a7043805..63a0045ef9c5 100644 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c @@ -1057,14 +1057,21 @@ static inline int vchiq_get_user_ptr(void __user **buf, void __user *ubuf, int i compat_uptr_t ptr32; compat_uptr_t __user *uptr = ubuf; ret = get_user(ptr32, uptr + index); + if (ret) + return ret; + *buf = compat_ptr(ptr32); } else { uintptr_t ptr, __user *uptr = ubuf; ret = get_user(ptr, uptr + index); + + if (ret) + return ret; + *buf = (void __user *)ptr; } - return ret; + return 0; } struct vchiq_completion_data32 { -- 2.29.2