Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Wed, 31 Mar 2021 11:48:17 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Muhammad Usama Anjum <musamaanjum@gmail.com>
Cc:     Jens Axboe <axboe@kernel.dk>,
        Pavel Begunkov <asml.silence@gmail.com>,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org,
        colin.king@canonical.com
Subject: Re: [PATCH] io_uring: Initialize variable before use
Message-ID: <20210331084817.GH2088@kadam>
References: <20210322184158.GA2095479@LEGION>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210322184158.GA2095479@LEGION>
User-Agent: Mutt/1.9.4 (2018-02-28)
Precedence: bulk

On Mon, Mar 22, 2021 at 11:41:58PM +0500, Muhammad Usama Anjum wrote:
> 1) Initialize the struct msghdr msg in the start of the function
> 2) Uninitialized variable msg.msg_flags can get used if branch happens to
> out_free before initialization.
> 
> So initialize variable in question in the start of the function for
> simplicity in logic and use.
> 
> Addresses-Coverity: ("Uninitialized variable")
> Addresses-Coverity: ("Uninitialized variable read")

This bug is a false positive.

When msg.msg_flags is uninitialized then ret is negative and min_ret is
zero.

fs/io_uring.c
  4666                  ret = -EINTR;
  4667  out_free:
  4668          if (req->flags & REQ_F_BUFFER_SELECTED)
  4669                  cflags = io_put_recv_kbuf(req);
  4670          if (ret < min_ret || ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))))
                    ^^^^^^^^^^^^^                               ^^^^^^^^^^^^^
The first part of the condition is true so the second part is not used.

  4671                  req_set_fail_links(req);
  4672          __io_req_complete(req, issue_flags, ret, cflags);
  4673          return 0;
  4674  }

regards,
dan carpenter