2017-04-21 19:39:14

by Dan Carpenter

Subject: [PATCH] mtip32xx: Uninitialized variable in mtip_no_dev_cleanup()

We set "cmd->state = -ENODEV;" but "cmd" hasn't been initialized yet.
It's weird that GCC doesn't catch this.

Fixes: 4dda4735c581 ("mtip32xx: add a status field to struct mtip_cmd")
Signed-off-by: Dan Carpenter <[email protected]>
---
Not tested, please review carefully.

diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 66a6bd83faae..bd4bf70a5bcd 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -4105,14 +4105,12 @@ static int mtip_block_initialize(struct driver_data *dd)
static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
{
struct driver_data *dd = (struct driver_data *)data;
- struct mtip_cmd *cmd;
+ struct mtip_cmd *cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL);

if (likely(!reserv)) {
cmd->status = -ENODEV;
blk_mq_complete_request(rq);
} else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
-
- cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL);
if (cmd->comp_func)
cmd->comp_func(dd->port, MTIP_TAG_INTERNAL,
cmd, -ENODEV);

2017-04-21 19:42:49

by Jens Axboe

Subject: Re: [PATCH] mtip32xx: Uninitialized variable in mtip_no_dev_cleanup()

On 04/21/2017 01:37 PM, Dan Carpenter wrote:
> We set "cmd->state = -ENODEV;" but "cmd" hasn't been initialized yet.
> It's weird that GCC doesn't catch this.

That is weird...

> diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
> index 66a6bd83faae..bd4bf70a5bcd 100644
> --- a/drivers/block/mtip32xx/mtip32xx.c
> +++ b/drivers/block/mtip32xx/mtip32xx.c
> @@ -4105,14 +4105,12 @@ static int mtip_block_initialize(struct driver_data *dd)
> static void mtip_no_dev_cleanup(struct request *rq, void *data, bool reserv)
> {
> struct driver_data *dd = (struct driver_data *)data;
> - struct mtip_cmd *cmd;
> + struct mtip_cmd *cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL);
>
> if (likely(!reserv)) {
> cmd->status = -ENODEV;
> blk_mq_complete_request(rq);
> } else if (test_bit(MTIP_PF_IC_ACTIVE_BIT, &dd->port->flags)) {
> -
> - cmd = mtip_cmd_from_tag(dd, MTIP_TAG_INTERNAL);
> if (cmd->comp_func)
> cmd->comp_func(dd->port, MTIP_TAG_INTERNAL,
> cmd, -ENODEV);

This is wrong, you can't use the internal tag bit for both cases. A proper
fix was already merged earlier today:

http://git.kernel.dk/cgit/linux-block/commit/?h=for-4.12/block&id=95c55ff425faa190fd8ba55090fbdf33d8b2f0ae

--
Jens Axboe