Skip to content

Commit c6a45ee

Browse files
kevin-brodsky-armaxboe
authored andcommitted
ublk: prevent invalid access with DEBUG
ublk_ch_uring_cmd_local() may jump to the out label before initialising the io pointer. This will cause trouble if DEBUG is defined, because the pr_devel() call dereferences io. Clang reports: drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] 2403 | if (tag >= ub->dev_info.queue_depth) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here 2492 | __func__, cmd_op, tag, ret, io->flags); | Fix this by initialising io to NULL and checking it before dereferencing it. Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com> Fixes: 71f28f3 ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: Caleb Sander Mateos <csander@purestorage.com> Signed-off-by: Jens Axboe <axboe@kernel.dk>
1 parent a857d99 commit c6a45ee

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

drivers/block/ublk_drv.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2301,7 +2301,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
23012301
u16 buf_idx = UBLK_INVALID_BUF_IDX;
23022302
struct ublk_device *ub = cmd->file->private_data;
23032303
struct ublk_queue *ubq;
2304-
struct ublk_io *io;
2304+
struct ublk_io *io = NULL;
23052305
u32 cmd_op = cmd->cmd_op;
23062306
u16 q_id = READ_ONCE(ub_src->q_id);
23072307
u16 tag = READ_ONCE(ub_src->tag);
@@ -2422,7 +2422,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
24222422

24232423
out:
24242424
pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n",
2425-
__func__, cmd_op, tag, ret, io->flags);
2425+
__func__, cmd_op, tag, ret, io ? io->flags : 0);
24262426
return ret;
24272427
}
24282428

0 commit comments

Comments
 (0)