tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 5631c5e0eb9035d92ceb20fcd9cdb7779a3f5cc7 commit: 3f649ab728cda8038259d8f14492fe400fbab911 treewide: Remove uninitialized_var() usage date: 3 weeks ago config: x86_64-randconfig-m031-20200807 (attached as .config) compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot <l...@intel.com> smatch warnings: drivers/vhost/net.c:1080 get_rx_bufs() error: uninitialized symbol 'len'. vim +/len +1080 drivers/vhost/net.c 03088137246065 Jason Wang 2016-03-04 1018 8dd014adfea6f1 David Stevens 2010-07-27 1019 /* This is a multi-buffer version of vhost_get_desc, that works if 8dd014adfea6f1 David Stevens 2010-07-27 1020 * vq has read descriptors only. 8dd014adfea6f1 David Stevens 2010-07-27 1021 * @vq - the relevant virtqueue 8dd014adfea6f1 David Stevens 2010-07-27 1022 * @datalen - data length we'll be reading 8dd014adfea6f1 David Stevens 2010-07-27 1023 * @iovcount - returned count of io vectors we fill 8dd014adfea6f1 David Stevens 2010-07-27 1024 * @log - vhost log 8dd014adfea6f1 David Stevens 2010-07-27 1025 * @log_num - log offset 94249369e99302 Jason Wang 2011-01-17 1026 * @quota - headcount quota, 1 for big buffer 8dd014adfea6f1 David Stevens 2010-07-27 1027 * returns number of buffer heads allocated, negative on error 8dd014adfea6f1 David Stevens 2010-07-27 1028 */ 8dd014adfea6f1 David Stevens 2010-07-27 1029 static int get_rx_bufs(struct vhost_virtqueue *vq, 8dd014adfea6f1 David Stevens 2010-07-27 1030 struct vring_used_elem *heads, 8dd014adfea6f1 David Stevens 2010-07-27 1031 int datalen, 8dd014adfea6f1 David Stevens 2010-07-27 1032 unsigned *iovcount, 8dd014adfea6f1 David Stevens 2010-07-27 1033 struct vhost_log *log, 94249369e99302 Jason Wang 2011-01-17 1034 unsigned *log_num, 94249369e99302 Jason Wang 2011-01-17 1035 unsigned int quota) 8dd014adfea6f1 David Stevens 2010-07-27 1036 { 8dd014adfea6f1 David Stevens 2010-07-27 1037 unsigned int out, in; 8dd014adfea6f1 David Stevens 2010-07-27 1038 int seg = 0; 8dd014adfea6f1 David Stevens 2010-07-27 1039 int headcount = 0; 8dd014adfea6f1 David Stevens 2010-07-27 1040 unsigned d; 8dd014adfea6f1 David Stevens 2010-07-27 1041 int r, nlogs = 0; 8b38694a2dc8b1 Michael S. Tsirkin 2014-10-24 1042 /* len is always initialized before use since we are always called with 8b38694a2dc8b1 Michael S. Tsirkin 2014-10-24 1043 * datalen > 0. 8b38694a2dc8b1 Michael S. Tsirkin 2014-10-24 1044 */ 3f649ab728cda8 Kees Cook 2020-06-03 1045 u32 len; 8dd014adfea6f1 David Stevens 2010-07-27 1046 94249369e99302 Jason Wang 2011-01-17 1047 while (datalen > 0 && headcount < quota) { e0e9b406470b8d Jason Wang 2010-09-14 1048 if (unlikely(seg >= UIO_MAXIOV)) { 8dd014adfea6f1 David Stevens 2010-07-27 1049 r = -ENOBUFS; 8dd014adfea6f1 David Stevens 2010-07-27 1050 goto err; 8dd014adfea6f1 David Stevens 2010-07-27 1051 } 47283bef7ed356 Michael S. Tsirkin 2014-06-05 1052 r = vhost_get_vq_desc(vq, vq->iov + seg, 8dd014adfea6f1 David Stevens 2010-07-27 1053 ARRAY_SIZE(vq->iov) - seg, &out, 8dd014adfea6f1 David Stevens 2010-07-27 1054 &in, log, log_num); a39ee449f96a2c Michael S. Tsirkin 2014-03-27 1055 if (unlikely(r < 0)) a39ee449f96a2c Michael S. Tsirkin 2014-03-27 1056 goto err; a39ee449f96a2c Michael S. Tsirkin 2014-03-27 1057 a39ee449f96a2c Michael S. Tsirkin 2014-03-27 1058 d = r; 8dd014adfea6f1 David Stevens 2010-07-27 1059 if (d == vq->num) { 8dd014adfea6f1 David Stevens 2010-07-27 1060 r = 0; 8dd014adfea6f1 David Stevens 2010-07-27 1061 goto err; 8dd014adfea6f1 David Stevens 2010-07-27 1062 } 8dd014adfea6f1 David Stevens 2010-07-27 1063 if (unlikely(out || in <= 0)) { 8dd014adfea6f1 David Stevens 2010-07-27 1064 vq_err(vq, "unexpected descriptor format for RX: " 8dd014adfea6f1 David Stevens 2010-07-27 1065 "out %d, in %d\n", out, in); 8dd014adfea6f1 David Stevens 2010-07-27 1066 r = -EINVAL; 8dd014adfea6f1 David Stevens 2010-07-27 1067 goto err; 8dd014adfea6f1 David Stevens 2010-07-27 1068 } 8dd014adfea6f1 David Stevens 2010-07-27 1069 if (unlikely(log)) { 8dd014adfea6f1 David Stevens 2010-07-27 1070 nlogs += *log_num; 8dd014adfea6f1 David Stevens 2010-07-27 1071 log += *log_num; 8dd014adfea6f1 David Stevens 2010-07-27 1072 } 8b38694a2dc8b1 Michael S. Tsirkin 2014-10-24 1073 heads[headcount].id = cpu_to_vhost32(vq, d); 8b38694a2dc8b1 Michael S. Tsirkin 2014-10-24 1074 len = iov_length(vq->iov + seg, in); 8b38694a2dc8b1 Michael S. Tsirkin 2014-10-24 1075 heads[headcount].len = cpu_to_vhost32(vq, len); 8b38694a2dc8b1 Michael S. Tsirkin 2014-10-24 1076 datalen -= len; 8dd014adfea6f1 David Stevens 2010-07-27 1077 ++headcount; 8dd014adfea6f1 David Stevens 2010-07-27 1078 seg += in; 8dd014adfea6f1 David Stevens 2010-07-27 1079 } 99975cc6ada0d5 Michael S. Tsirkin 2015-01-07 @1080 heads[headcount - 1].len = cpu_to_vhost32(vq, len + datalen); 8dd014adfea6f1 David Stevens 2010-07-27 1081 *iovcount = seg; 8dd014adfea6f1 David Stevens 2010-07-27 1082 if (unlikely(log)) 8dd014adfea6f1 David Stevens 2010-07-27 1083 *log_num = nlogs; d8316f3991d207 Michael S. Tsirkin 2014-03-27 1084 d8316f3991d207 Michael S. Tsirkin 2014-03-27 1085 /* Detect overrun */ d8316f3991d207 Michael S. Tsirkin 2014-03-27 1086 if (unlikely(datalen > 0)) { d8316f3991d207 Michael S. Tsirkin 2014-03-27 1087 r = UIO_MAXIOV + 1; d8316f3991d207 Michael S. Tsirkin 2014-03-27 1088 goto err; d8316f3991d207 Michael S. Tsirkin 2014-03-27 1089 } 8dd014adfea6f1 David Stevens 2010-07-27 1090 return headcount; 8dd014adfea6f1 David Stevens 2010-07-27 1091 err: 8dd014adfea6f1 David Stevens 2010-07-27 1092 vhost_discard_vq_desc(vq, headcount); 8dd014adfea6f1 David Stevens 2010-07-27 1093 return r; 8dd014adfea6f1 David Stevens 2010-07-27 1094 } 8dd014adfea6f1 David Stevens 2010-07-27 1095 :::::: The code at line 1080 was first introduced by commit :::::: 99975cc6ada0d5f2675e83abecae05aba5f437d2 vhost/net: length miscalculation :::::: TO: Michael S. Tsirkin <m...@redhat.com> :::::: CC: Michael S. Tsirkin <m...@redhat.com> --- 0-DAY CI Kernel Test Service, Intel Corporation https://lists.01.org/hyperkitty/list/kbuild-...@lists.01.org
.config.gz
Description: application/gzip