public inbox for [email protected]
 help / color / mirror / Atom feed
* Re: FAILED: patch "[PATCH] io_uring: Clean up a false-positive warning from GCC 9.3.0" failed to apply to 5.10-stable tree
       [not found] <[email protected]>
@ 2023-01-22 15:43 ` Alviro Iskandar Setiawan
  2023-01-22 17:47   ` Jens Axboe
  0 siblings, 1 reply; 2+ messages in thread
From: Alviro Iskandar Setiawan @ 2023-01-22 15:43 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Ammar Faizi, Pavel Begunkov, Jens Axboe, Dan Carpenter,
	kernel test robot, Chen Rong A., stable, io-uring Mailing list,
	GNU/Weeb Mailing List

On Sun, Jan 22, 2023 at 9:44 PM <[email protected]> wrote:
> The patch below does not apply to the 5.10-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <[email protected]>.

That uninitialized reading is living in 5.10.y branch now
https://github.com/gregkh/linux/blob/v5.10.162/io_uring/io_uring.c#L4989-L5017

If this:

   ret = import_single_range(RE AD, buf, sr->len, &iov, &msg.msg_iter);

fails, this one (flags & MSG_WAITALL) may read an uninitialized
variable because @flags is uninitialized.

Fortunately, if import_single_range() fails, (ret < min_ret) is always
true, so this:

    ret < min_ret || ((flags & MSG_WAITALL)

will always short circuit. But no one tells the compiler if @ret is
always less than @min_ret in that case. So it can't prove that @flags
is never actually read. That still falls to undefined behavior anyway,
the compiler may emit "ud2" or similar trap for that or behave
randomly. IDK...

^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: FAILED: patch "[PATCH] io_uring: Clean up a false-positive warning from GCC 9.3.0" failed to apply to 5.10-stable tree
  2023-01-22 15:43 ` FAILED: patch "[PATCH] io_uring: Clean up a false-positive warning from GCC 9.3.0" failed to apply to 5.10-stable tree Alviro Iskandar Setiawan
@ 2023-01-22 17:47   ` Jens Axboe
  0 siblings, 0 replies; 2+ messages in thread
From: Jens Axboe @ 2023-01-22 17:47 UTC (permalink / raw)
  To: Alviro Iskandar Setiawan, Greg Kroah-Hartman
  Cc: Ammar Faizi, Pavel Begunkov, Dan Carpenter, kernel test robot,
	Chen Rong A., stable, io-uring Mailing list,
	GNU/Weeb Mailing List

On 1/22/23 8:43 AM, Alviro Iskandar Setiawan wrote:
> On Sun, Jan 22, 2023 at 9:44 PM <[email protected]> wrote:
>> The patch below does not apply to the 5.10-stable tree.
>> If someone wants it applied there, or to any other stable or longterm
>> tree, then please email the backport, including the original git commit
>> id to <[email protected]>.
> 
> That uninitialized reading is living in 5.10.y branch now
> https://github.com/gregkh/linux/blob/v5.10.162/io_uring/io_uring.c#L4989-L5017
> 
> If this:
> 
>    ret = import_single_range(RE AD, buf, sr->len, &iov, &msg.msg_iter);
> 
> fails, this one (flags & MSG_WAITALL) may read an uninitialized
> variable because @flags is uninitialized.
> 
> Fortunately, if import_single_range() fails, (ret < min_ret) is always
> true, so this:
> 
>     ret < min_ret || ((flags & MSG_WAITALL)
> 
> will always short circuit. But no one tells the compiler if @ret is
> always less than @min_ret in that case. So it can't prove that @flags
> is never actually read. That still falls to undefined behavior anyway,
> the compiler may emit "ud2" or similar trap for that or behave
> randomly. IDK...

Now handled for both trees.

-- 
Jens Axboe



^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2023-01-22 17:48 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <[email protected]>
2023-01-22 15:43 ` FAILED: patch "[PATCH] io_uring: Clean up a false-positive warning from GCC 9.3.0" failed to apply to 5.10-stable tree Alviro Iskandar Setiawan
2023-01-22 17:47   ` Jens Axboe

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox