lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 300/459] visorbus: fix uninitialized variable access
    Date
    From: Arnd Bergmann <arnd@arndb.de>

    [ Upstream commit caf82f727e69b647f09d57a1fc56e69d22a5f483 ]

    The setup_crash_devices_work_queue function only partially initializes
    the message it sends to chipset_init, leading to undefined behavior:

    drivers/visorbus/visorchipset.c: In function 'setup_crash_devices_work_queue':
    drivers/visorbus/visorchipset.c:333:6: error: '((unsigned char*)&msg.hdr.flags)[0]' is used uninitialized in this function [-Werror=uninitialized]
    if (inmsg->hdr.flags.response_expected)

    Set up the entire structure, zero-initializing the 'response_expected'
    flag.

    This was apparently found by the patch that added the -O3 build option
    in Kconfig.

    Fixes: 12e364b9f08a ("staging: visorchipset driver to provide registration and other services")
    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Link: https://lore.kernel.org/r/20200107202950.782951-1-arnd@arndb.de
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/visorbus/visorchipset.c | 11 +++++++----
    1 file changed, 7 insertions(+), 4 deletions(-)

    diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c
    index ca752b8f495fa..cb1eb7e05f871 100644
    --- a/drivers/visorbus/visorchipset.c
    +++ b/drivers/visorbus/visorchipset.c
    @@ -1210,14 +1210,17 @@ static void setup_crash_devices_work_queue(struct work_struct *work)
    {
    struct controlvm_message local_crash_bus_msg;
    struct controlvm_message local_crash_dev_msg;
    - struct controlvm_message msg;
    + struct controlvm_message msg = {
    + .hdr.id = CONTROLVM_CHIPSET_INIT,
    + .cmd.init_chipset = {
    + .bus_count = 23,
    + .switch_count = 0,
    + },
    + };
    u32 local_crash_msg_offset;
    u16 local_crash_msg_count;

    /* send init chipset msg */
    - msg.hdr.id = CONTROLVM_CHIPSET_INIT;
    - msg.cmd.init_chipset.bus_count = 23;
    - msg.cmd.init_chipset.switch_count = 0;
    chipset_init(&msg);
    /* get saved message count */
    if (visorchannel_read(chipset_dev->controlvm_channel,
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 17:09    [W:2.303 / U:0.524 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site