public inbox for [email protected]
 help / color / mirror / Atom feed
* [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value
       [not found] <[email protected]>
@ 2022-02-07 11:43 ` Ammar Faizi
  2022-02-07 13:45   ` Jens Axboe
  0 siblings, 1 reply; 7+ messages in thread
From: Ammar Faizi @ 2022-02-07 11:43 UTC (permalink / raw)
  To: Jens Axboe
  Cc: GNU/Weeb Mailing List, io-uring Mailing list,
	Tea Inside Mailing List, Linux Kernel Mailing List,
	Alviro Iskandar Setiawan, kernel test robot, Dan Carpenter,
	Chen, Rong A, Pavel Begunkov, Ammar Faizi

From: Alviro Iskandar Setiawan <[email protected]>

In io_recv() if import_single_range() fails, the @flags variable is
uninitialized, then it will goto out_free.

After the goto, the compiler doesn't know that (ret < min_ret) is
always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
could be taken.

The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
```
  fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
```
Fix this by bypassing the @ret and @flags check when
import_single_range() fails.

Reasons:
 1. import_single_range() only returns -EFAULT when it fails.
 2. At that point @flags is uninitialized and shouldn't be read.

Reported-by: kernel test robot <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
Reported-by: "Chen, Rong A" <[email protected]>
Link: https://lore.gnuweeb.org/timl/[email protected]/
Cc: Pavel Begunkov <[email protected]>
Suggested-by: Ammar Faizi <[email protected]>
Fixes: 7297ce3d59449de49d3c9e1f64ae25488750a1fc ("io_uring: improve send/recv error handling")
Signed-off-by: Alviro Iskandar Setiawan <[email protected]>
Signed-off-by: Ammar Faizi <[email protected]>
---
 fs/io_uring.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2e04f718319d..3445c4da0153 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5228,7 +5228,6 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 		min_ret = iov_iter_count(&msg.msg_iter);
 
 	ret = sock_recvmsg(sock, &msg, flags);
-out_free:
 	if (ret < min_ret) {
 		if (ret == -EAGAIN && force_nonblock)
 			return -EAGAIN;
@@ -5236,9 +5235,9 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 			ret = -EINTR;
 		req_set_fail(req);
 	} else if ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))) {
+out_free:
 		req_set_fail(req);
 	}
-
 	__io_req_complete(req, issue_flags, ret, io_put_kbuf(req));
 	return 0;
 }

base-commit: f6133fbd373811066c8441737e65f384c8f31974
-- 
2.32.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value
  2022-02-07 11:43 ` [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value Ammar Faizi
@ 2022-02-07 13:45   ` Jens Axboe
  2022-02-07 14:05     ` [PATCH io_uring-5.17 v2] io_uring: Clean up a false-positive warning from GCC 9.3.0 Ammar Faizi
  2022-02-07 14:20     ` [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value Dan Carpenter
  0 siblings, 2 replies; 7+ messages in thread
From: Jens Axboe @ 2022-02-07 13:45 UTC (permalink / raw)
  To: Ammar Faizi
  Cc: GNU/Weeb Mailing List, io-uring Mailing list,
	Tea Inside Mailing List, Linux Kernel Mailing List,
	Alviro Iskandar Setiawan, kernel test robot, Dan Carpenter,
	Chen, Rong A, Pavel Begunkov

On 2/7/22 4:43 AM, Ammar Faizi wrote:
> From: Alviro Iskandar Setiawan <[email protected]>
> 
> In io_recv() if import_single_range() fails, the @flags variable is
> uninitialized, then it will goto out_free.
> 
> After the goto, the compiler doesn't know that (ret < min_ret) is
> always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
> could be taken.
> 
> The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
> ```
>   fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
> ```
> Fix this by bypassing the @ret and @flags check when
> import_single_range() fails.

The compiler should be able to deduce this, and I guess newer compilers
do which is why we haven't seen this warning before. I'm fine with doing
this as a cleanup, but I think the commit title should be modified a
bit. It sounds like there might be an issue reading uninitialized data,
which isn't actually true.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 7+ messages in thread

* [PATCH io_uring-5.17 v2] io_uring: Clean up a false-positive warning from GCC 9.3.0
  2022-02-07 13:45   ` Jens Axboe
@ 2022-02-07 14:05     ` Ammar Faizi
  2022-02-07 15:38       ` Jens Axboe
  2022-02-07 14:20     ` [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value Dan Carpenter
  1 sibling, 1 reply; 7+ messages in thread
From: Ammar Faizi @ 2022-02-07 14:05 UTC (permalink / raw)
  To: Jens Axboe
  Cc: GNU/Weeb Mailing List, io-uring Mailing list,
	Tea Inside Mailing List, Linux Kernel Mailing List,
	Alviro Iskandar Setiawan, kernel test robot, Dan Carpenter,
	Chen, Rong A, Pavel Begunkov, Ammar Faizi

From: Alviro Iskandar Setiawan <[email protected]>

In io_recv(), if import_single_range() fails, the @flags variable is
uninitialized, then it will goto out_free.

After the goto, the compiler doesn't know that (ret < min_ret) is
always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
could be taken.

The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
```
  fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
```
Fix this by bypassing the @ret and @flags check when
import_single_range() fails.

Reasons:
 1. import_single_range() only returns -EFAULT when it fails.
 2. At that point, @flags is uninitialized and shouldn't be read.

Reported-by: kernel test robot <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
Reported-by: "Chen, Rong A" <[email protected]>
Link: https://lore.gnuweeb.org/timl/[email protected]/
Cc: Pavel Begunkov <[email protected]>
Suggested-by: Ammar Faizi <[email protected]>
Fixes: 7297ce3d59449de49d3c9e1f64ae25488750a1fc ("io_uring: improve send/recv error handling")
Signed-off-by: Alviro Iskandar Setiawan <[email protected]>
Signed-off-by: Ammar Faizi <[email protected]>
---

 v2:
   - Update the subject line

 fs/io_uring.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 2e04f718319d..3445c4da0153 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5228,7 +5228,6 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 		min_ret = iov_iter_count(&msg.msg_iter);
 
 	ret = sock_recvmsg(sock, &msg, flags);
-out_free:
 	if (ret < min_ret) {
 		if (ret == -EAGAIN && force_nonblock)
 			return -EAGAIN;
@@ -5236,9 +5235,9 @@ static int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 			ret = -EINTR;
 		req_set_fail(req);
 	} else if ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))) {
+out_free:
 		req_set_fail(req);
 	}
-
 	__io_req_complete(req, issue_flags, ret, io_put_kbuf(req));
 	return 0;
 }

base-commit: f6133fbd373811066c8441737e65f384c8f31974
-- 
2.32.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread

* Re: [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value
  2022-02-07 13:45   ` Jens Axboe
  2022-02-07 14:05     ` [PATCH io_uring-5.17 v2] io_uring: Clean up a false-positive warning from GCC 9.3.0 Ammar Faizi
@ 2022-02-07 14:20     ` Dan Carpenter
  2022-02-07 14:33       ` Alviro Iskandar Setiawan
  1 sibling, 1 reply; 7+ messages in thread
From: Dan Carpenter @ 2022-02-07 14:20 UTC (permalink / raw)
  To: Jens Axboe
  Cc: Ammar Faizi, GNU/Weeb Mailing List, io-uring Mailing list,
	Tea Inside Mailing List, Linux Kernel Mailing List,
	Alviro Iskandar Setiawan, kernel test robot, Chen, Rong A,
	Pavel Begunkov

On Mon, Feb 07, 2022 at 06:45:57AM -0700, Jens Axboe wrote:
> On 2/7/22 4:43 AM, Ammar Faizi wrote:
> > From: Alviro Iskandar Setiawan <[email protected]>
> > 
> > In io_recv() if import_single_range() fails, the @flags variable is
> > uninitialized, then it will goto out_free.
> > 
> > After the goto, the compiler doesn't know that (ret < min_ret) is
> > always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
> > could be taken.
> > 
> > The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
> > ```
> >   fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
> > ```
> > Fix this by bypassing the @ret and @flags check when
> > import_single_range() fails.
> 
> The compiler should be able to deduce this, and I guess newer compilers
> do which is why we haven't seen this warning before.

No, we disabled GCC's uninitialized variable checking a couple years
back.  Linus got sick of the false positives.  You can still see it if
you enable W=2

fs/io_uring.c: In function ‘io_recv’:
fs/io_uring.c:5252:20: warning: ‘flags’ may be used uninitialized in this function [-Wmaybe-uninitialized]
  } else if ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))) {
             ~~~~~~~^~~~~~~~~~~~~~

If you introduce an uninitialized variable bug then likelyhood is the
kbuild-bot will send you a Clang warning or a Smatch warning or both.
I don't think anyone looks at GCC W=2 warnings.

regards,
dan carpenter


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value
  2022-02-07 14:20     ` [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value Dan Carpenter
@ 2022-02-07 14:33       ` Alviro Iskandar Setiawan
  2022-02-07 15:37         ` Jens Axboe
  0 siblings, 1 reply; 7+ messages in thread
From: Alviro Iskandar Setiawan @ 2022-02-07 14:33 UTC (permalink / raw)
  To: Dan Carpenter
  Cc: Jens Axboe, Ammar Faizi, GNU/Weeb Mailing List,
	io-uring Mailing list, Tea Inside Mailing List,
	Linux Kernel Mailing List, kernel test robot, Chen, Rong A,
	Pavel Begunkov

On Mon, Feb 7, 2022 at 9:21 PM Dan Carpenter <[email protected]> wrote:
> On Mon, Feb 07, 2022 at 06:45:57AM -0700, Jens Axboe wrote:
> > On 2/7/22 4:43 AM, Ammar Faizi wrote:
> > > From: Alviro Iskandar Setiawan <[email protected]>
> > >
> > > In io_recv() if import_single_range() fails, the @flags variable is
> > > uninitialized, then it will goto out_free.
> > >
> > > After the goto, the compiler doesn't know that (ret < min_ret) is
> > > always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
> > > could be taken.
> > >
> > > The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
> > > ```
> > >   fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
> > > ```
> > > Fix this by bypassing the @ret and @flags check when
> > > import_single_range() fails.
> >
> > The compiler should be able to deduce this, and I guess newer compilers
> > do which is why we haven't seen this warning before.

The compiler can't deduce this because the import_single_range() is
located in a different translation unit (different C file), so it
can't prove that (ret < min_ret) is always true as it can't see the
function definition (in reality, it is always true because it only
returns either 0 or -EFAULT).

>
> No, we disabled GCC's uninitialized variable checking a couple years
> back.  Linus got sick of the false positives.  You can still see it if
> you enable W=2
>
> fs/io_uring.c: In function ‘io_recv’:
> fs/io_uring.c:5252:20: warning: ‘flags’ may be used uninitialized in this function [-Wmaybe-uninitialized]
>   } else if ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))) {
>              ~~~~~~~^~~~~~~~~~~~~~
>
> If you introduce an uninitialized variable bug then likelyhood is the
> kbuild-bot will send you a Clang warning or a Smatch warning or both.
> I don't think anyone looks at GCC W=2 warnings.
>

This warning is valid, and the compiler should really warn that. But
again, in reality, this is still a false-positive warning, because
that "else if" will never be taken from the "goto out_free" path.

-- Viro

^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value
  2022-02-07 14:33       ` Alviro Iskandar Setiawan
@ 2022-02-07 15:37         ` Jens Axboe
  0 siblings, 0 replies; 7+ messages in thread
From: Jens Axboe @ 2022-02-07 15:37 UTC (permalink / raw)
  To: Alviro Iskandar Setiawan, Dan Carpenter
  Cc: Ammar Faizi, GNU/Weeb Mailing List, io-uring Mailing list,
	Tea Inside Mailing List, Linux Kernel Mailing List,
	kernel test robot, Chen, Rong A, Pavel Begunkov

On 2/7/22 7:33 AM, Alviro Iskandar Setiawan wrote:
> On Mon, Feb 7, 2022 at 9:21 PM Dan Carpenter <[email protected]> wrote:
>> On Mon, Feb 07, 2022 at 06:45:57AM -0700, Jens Axboe wrote:
>>> On 2/7/22 4:43 AM, Ammar Faizi wrote:
>>>> From: Alviro Iskandar Setiawan <[email protected]>
>>>>
>>>> In io_recv() if import_single_range() fails, the @flags variable is
>>>> uninitialized, then it will goto out_free.
>>>>
>>>> After the goto, the compiler doesn't know that (ret < min_ret) is
>>>> always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
>>>> could be taken.
>>>>
>>>> The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
>>>> ```
>>>>   fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
>>>> ```
>>>> Fix this by bypassing the @ret and @flags check when
>>>> import_single_range() fails.
>>>
>>> The compiler should be able to deduce this, and I guess newer compilers
>>> do which is why we haven't seen this warning before.
> 
> The compiler can't deduce this because the import_single_range() is
> located in a different translation unit (different C file), so it
> can't prove that (ret < min_ret) is always true as it can't see the
> function definition (in reality, it is always true because it only
> returns either 0 or -EFAULT).

Yes you are right, I forgot this is the generic helper, and not our
internal one.

>> No, we disabled GCC's uninitialized variable checking a couple years
>> back.  Linus got sick of the false positives.  You can still see it if
>> you enable W=2
>>
>> fs/io_uring.c: In function ‘io_recv’:
>> fs/io_uring.c:5252:20: warning: ‘flags’ may be used uninitialized in this function [-Wmaybe-uninitialized]
>>   } else if ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))) {
>>              ~~~~~~~^~~~~~~~~~~~~~
>>
>> If you introduce an uninitialized variable bug then likelyhood is the
>> kbuild-bot will send you a Clang warning or a Smatch warning or both.
>> I don't think anyone looks at GCC W=2 warnings.
>>
> 
> This warning is valid, and the compiler should really warn that. But
> again, in reality, this is still a false-positive warning, because
> that "else if" will never be taken from the "goto out_free" path.

Right, as mentioned in my email, there is no bug there. But I do like
the patch as it cleans it up too, the error-out path should not include
non-cleanup items.

-- 
Jens Axboe


^ permalink raw reply	[flat|nested] 7+ messages in thread

* Re: [PATCH io_uring-5.17 v2] io_uring: Clean up a false-positive warning from GCC 9.3.0
  2022-02-07 14:05     ` [PATCH io_uring-5.17 v2] io_uring: Clean up a false-positive warning from GCC 9.3.0 Ammar Faizi
@ 2022-02-07 15:38       ` Jens Axboe
  0 siblings, 0 replies; 7+ messages in thread
From: Jens Axboe @ 2022-02-07 15:38 UTC (permalink / raw)
  To: Ammar Faizi
  Cc: Chen, Rong A, Linux Kernel Mailing List, Alviro Iskandar Setiawan,
	io-uring Mailing list, GNU/Weeb Mailing List, Dan Carpenter,
	Pavel Begunkov, Tea Inside Mailing List, kernel test robot

On Mon, 7 Feb 2022 21:05:33 +0700, Ammar Faizi wrote:
> From: Alviro Iskandar Setiawan <[email protected]>
> 
> In io_recv(), if import_single_range() fails, the @flags variable is
> uninitialized, then it will goto out_free.
> 
> After the goto, the compiler doesn't know that (ret < min_ret) is
> always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
> could be taken.
> 
> [...]

Applied, thanks!

[1/1] io_uring: Clean up a false-positive warning from GCC 9.3.0
      commit: 0d7c1153d9291197c1dc473cfaade77acb874b4b

Best regards,
-- 
Jens Axboe



^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2022-02-07 15:47 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <[email protected]>
2022-02-07 11:43 ` [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value Ammar Faizi
2022-02-07 13:45   ` Jens Axboe
2022-02-07 14:05     ` [PATCH io_uring-5.17 v2] io_uring: Clean up a false-positive warning from GCC 9.3.0 Ammar Faizi
2022-02-07 15:38       ` Jens Axboe
2022-02-07 14:20     ` [PATCH io_uring-5.17] io_uring: Fix build error potential reading uninitialized value Dan Carpenter
2022-02-07 14:33       ` Alviro Iskandar Setiawan
2022-02-07 15:37         ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox