Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20190617131210.2190280-1-arnd@arndb.de>
In-Reply-To: <20190617131210.2190280-1-arnd@arndb.de>
From:   Alexander Potapenko <glider@google.com>
Date:   Mon, 17 Jun 2019 16:22:19 +0200
Message-ID: <CAG_fn=XigLrxy6Uz+NrnHQocb=ZseR6cPC3PyoLXCLU9gukHXg@mail.gmail.com>
Subject: Re: [PATCH] lib: test_meminit: fix -Wmaybe-uninitialized false positive
To:     Arnd Bergmann <arnd@arndb.de>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Kees Cook <keescook@chromium.org>,
        Christoph Lameter <cl@linux.com>,
        Nick Desaulniers <ndesaulniers@google.com>,
        Kostya Serebryany <kcc@google.com>,
        Dmitry Vyukov <dvyukov@google.com>,
        Sandeep Patil <sspatil@android.com>,
        Laura Abbott <labbott@redhat.com>,
        Jann Horn <jannh@google.com>, Marco Elver <elver@google.com>,
        Stephen Rothwell <sfr@canb.auug.org.au>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Jun 17, 2019 at 3:12 PM Arnd Bergmann <arnd@arndb.de> wrote:
>
> The conditional logic is too complicated for the compiler to
> fully comprehend:
>
> lib/test_meminit.c: In function 'test_meminit_init':
> lib/test_meminit.c:236:5: error: 'buf_copy' may be used uninitialized in =
this function [-Werror=3Dmaybe-uninitialized]
>      kfree(buf_copy);
>      ^~~~~~~~~~~~~~~
> lib/test_meminit.c:201:14: note: 'buf_copy' was declared here
>
> Simplify it by splitting out the non-rcu section.
>
> Fixes: af734ee6ec85 ("lib: introduce test_meminit module")
> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Alexander Potapenko <glider@google.com>
> ---
>  lib/test_meminit.c | 50 ++++++++++++++++++++++++----------------------
>  1 file changed, 26 insertions(+), 24 deletions(-)
>
> diff --git a/lib/test_meminit.c b/lib/test_meminit.c
> index ed7efec1387b..7ae2183ff1f4 100644
> --- a/lib/test_meminit.c
> +++ b/lib/test_meminit.c
> @@ -208,35 +208,37 @@ static int __init do_kmem_cache_size(size_t size, b=
ool want_ctor,
>                 /* Check that buf is zeroed, if it must be. */
>                 fail =3D check_buf(buf, size, want_ctor, want_rcu, want_z=
ero);
>                 fill_with_garbage_skip(buf, size, want_ctor ? CTOR_BYTES =
: 0);
> +
> +               if (!want_rcu) {
> +                       kmem_cache_free(c, buf);
> +                       continue;
> +               }
> +
>                 /*
>                  * If this is an RCU cache, use a critical section to ens=
ure we
>                  * can touch objects after they're freed.
>                  */
> -               if (want_rcu) {
> -                       rcu_read_lock();
> -                       /*
> -                        * Copy the buffer to check that it's not wiped o=
n
> -                        * free().
> -                        */
> -                       buf_copy =3D kmalloc(size, GFP_KERNEL);
> -                       if (buf_copy)
> -                               memcpy(buf_copy, buf, size);
> -               }
> -               kmem_cache_free(c, buf);
> -               if (want_rcu) {
> -                       /*
> -                        * Check that |buf| is intact after kmem_cache_fr=
ee().
> -                        * |want_zero| is false, because we wrote garbage=
 to
> -                        * the buffer already.
> -                        */
> -                       fail |=3D check_buf(buf, size, want_ctor, want_rc=
u,
> -                                         false);
> -                       if (buf_copy) {
> -                               fail |=3D (bool)memcmp(buf, buf_copy, siz=
e);
> -                               kfree(buf_copy);
> -                       }
> -                       rcu_read_unlock();
> +               rcu_read_lock();
> +               /*
> +                * Copy the buffer to check that it's not wiped on
> +                * free().
> +                */
> +               buf_copy =3D kmalloc(size, GFP_KERNEL);
> +               if (buf_copy)
> +                       memcpy(buf_copy, buf, size);
> +
> +               /*
> +                * Check that |buf| is intact after kmem_cache_free().
> +                * |want_zero| is false, because we wrote garbage to
> +                * the buffer already.
> +                */
> +               fail |=3D check_buf(buf, size, want_ctor, want_rcu,
> +                                 false);
> +               if (buf_copy) {
> +                       fail |=3D (bool)memcmp(buf, buf_copy, size);
> +                       kfree(buf_copy);
>                 }
> +               rcu_read_unlock();
>         }
>         kmem_cache_destroy(c);
>
> --
> 2.20.0
>


--=20
Alexander Potapenko
Software Engineer

Google Germany GmbH
Erika-Mann-Stra=C3=9Fe, 33
80636 M=C3=BCnchen

Gesch=C3=A4ftsf=C3=BChrer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg