Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Subject: Re: [PATCH io_uring-5.17] io_uring: Fix build error potential reading
 uninitialized value
To:     Alviro Iskandar Setiawan <alviro.iskandar@gmail.com>,
        Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Ammar Faizi <ammarfaizi2@gnuweeb.org>,
        GNU/Weeb Mailing List <gwml@gnuweeb.org>,
        io-uring Mailing list <io-uring@vger.kernel.org>,
        Tea Inside Mailing List <timl@vger.teainside.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        kernel test robot <lkp@intel.com>,
        "Chen, Rong A" <rong.a.chen@intel.com>,
        Pavel Begunkov <asml.silence@gmail.com>
References: <d33bb5a9-8173-f65b-f653-51fc0681c6d6@intel.com>
 <20220207114315.555413-1-ammarfaizi2@gnuweeb.org>
 <91e8ca64-0670-d998-73d8-f75ec5264cb0@kernel.dk>
 <20220207142046.GP1978@kadam>
 <CAOG64qN1fQ_surhMJSuygyf_emSvFm3HKRgj_JAZteFVjaP3+A@mail.gmail.com>
From:   Jens Axboe <axboe@kernel.dk>
Message-ID: <e3373f74-d7a5-6279-0440-2342092eef90@kernel.dk>
Date:   Mon, 7 Feb 2022 08:37:50 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.10.0
MIME-Version: 1.0
In-Reply-To: <CAOG64qN1fQ_surhMJSuygyf_emSvFm3HKRgj_JAZteFVjaP3+A@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 2/7/22 7:33 AM, Alviro Iskandar Setiawan wrote:
> On Mon, Feb 7, 2022 at 9:21 PM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>> On Mon, Feb 07, 2022 at 06:45:57AM -0700, Jens Axboe wrote:
>>> On 2/7/22 4:43 AM, Ammar Faizi wrote:
>>>> From: Alviro Iskandar Setiawan <alviro.iskandar@gmail.com>
>>>>
>>>> In io_recv() if import_single_range() fails, the @flags variable is
>>>> uninitialized, then it will goto out_free.
>>>>
>>>> After the goto, the compiler doesn't know that (ret < min_ret) is
>>>> always true, so it thinks the "if ((flags & MSG_WAITALL) ..."  path
>>>> could be taken.
>>>>
>>>> The complaint comes from gcc-9 (Debian 9.3.0-22) 9.3.0:
>>>> ```
>>>>   fs/io_uring.c:5238 io_recvfrom() error: uninitialized symbol 'flags'
>>>> ```
>>>> Fix this by bypassing the @ret and @flags check when
>>>> import_single_range() fails.
>>>
>>> The compiler should be able to deduce this, and I guess newer compilers
>>> do which is why we haven't seen this warning before.
> 
> The compiler can't deduce this because the import_single_range() is
> located in a different translation unit (different C file), so it
> can't prove that (ret < min_ret) is always true as it can't see the
> function definition (in reality, it is always true because it only
> returns either 0 or -EFAULT).

Yes you are right, I forgot this is the generic helper, and not our
internal one.

>> No, we disabled GCC's uninitialized variable checking a couple years
>> back.  Linus got sick of the false positives.  You can still see it if
>> you enable W=2
>>
>> fs/io_uring.c: In function ‘io_recv’:
>> fs/io_uring.c:5252:20: warning: ‘flags’ may be used uninitialized in this function [-Wmaybe-uninitialized]
>>   } else if ((flags & MSG_WAITALL) && (msg.msg_flags & (MSG_TRUNC | MSG_CTRUNC))) {
>>              ~~~~~~~^~~~~~~~~~~~~~
>>
>> If you introduce an uninitialized variable bug then likelyhood is the
>> kbuild-bot will send you a Clang warning or a Smatch warning or both.
>> I don't think anyone looks at GCC W=2 warnings.
>>
> 
> This warning is valid, and the compiler should really warn that. But
> again, in reality, this is still a false-positive warning, because
> that "else if" will never be taken from the "goto out_free" path.

Right, as mentioned in my email, there is no bug there. But I do like
the patch as it cleans it up too, the error-out path should not include
non-cleanup items.

-- 
Jens Axboe