Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
Date:   Fri, 6 May 2022 12:13:38 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     ksummit-discuss@lists.linuxfoundation.org,
        linux-kernel@vger.kernel.org
Cc:     Nathan Chancellor <natechancellor@gmail.com>, kbuild@lists.01.org,
        lkp@intel.com
Subject: uninitialized variables bugs
Message-ID: <20220506091338.GE4031@kadam>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?ioAA8HyOH4X9T2RSdtevL28CWUwl9S/zzSgsG89vd7xhjmJb4fuMviyVXiSK?=
 =?us-ascii?Q?uyZZ3sFszbAU2QjkCKhu+RJ1AoMagp3Hr1Kn8UUhQDA9yEGw7AcDd/oKlby9?=
 =?us-ascii?Q?h01fvS+WQ2ganu1sF1Pi8fPM6WHwBDANLOv74SijLI5h4OvqgftsjC46cwGn?=
 =?us-ascii?Q?+ZyDcqbj398f9R2HdBF83jn9ASDwcqC0KlgYPw3pipXChtBrw1q0GKE13JmK?=
 =?us-ascii?Q?VNql0Dxc4X2YJmQIzPofy3JmqOojmXJvMNN7WTvbv2wBiz1rb+tm6oj6v7Lp?=
 =?us-ascii?Q?RIPPMJiF+cclW6X2/7CIWo7Yu2FfbEXYL8a2c/goWR/z8me/Vc3kOHm+DwhH?=
 =?us-ascii?Q?ypBcHREaPOIHq6u5qWMd16u6l2R1VnN5RTvYSMyikPbP1o2pUmniNQsqpQ5G?=
 =?us-ascii?Q?CFt03FnIEOEwy3qmzxTB5oYZfFtuKB04KQ6gZtTPnftyiFeWadYQV1iCJqO8?=
 =?us-ascii?Q?xVijkmmC4vz3wkgbtsVf2aS5CisV/XR9TG2UtBEyuAQ8M0P4tskpS1NAyx2i?=
 =?us-ascii?Q?ygQuv+GSSqbw4WEf/gIM5SzXmLeIIZ8vWLKksbmCXOYZbGE/uOk0ftv3tNf4?=
 =?us-ascii?Q?tdWqMdXcJNwS41FwlbDo47xzD0uOcLuVhc1lNjoaiSMwQH5qS4+dmLazoIhq?=
 =?us-ascii?Q?EV+ykW7ogEBb7kw3HgCkzb/QlaFALYINvhDPiEps/4EIG/9OC4RhHw6d57GA?=
 =?us-ascii?Q?XViBBvMyLYIQNmWF9TTxsG1U4gAunXEQXEfBqs3KVzCTE6QEjr2NSE/H+5h8?=
 =?us-ascii?Q?e21gXjTsShFbSGF76PMPYMxHcrhtU8mTAdvzI3+WMqm9Sncw24jmWRp7almv?=
 =?us-ascii?Q?XZ0VRXZKwczgoNC5qxHQJyYyVI69yGUpX8OgqEk7CHLuEP6d9UU1QfRFuHNq?=
 =?us-ascii?Q?Chmo/g2cpCen9Ff5pdTf+PweeO0de60Npcq96909zK16YgjanWJMmO0QN04J?=
 =?us-ascii?Q?AYYLzMtwHrN6fr9plaD8CC19wQKiV7InL9uPPp8ghNCLEcwjhlgyNllov0sJ?=
 =?us-ascii?Q?s66TPFhcsk7NYCegZet/ijzntAonMWAlWi/8k8l5gSNLnVYfv5sHu8QEdkl7?=
 =?us-ascii?Q?xQruoaH46LGTeudcm88mBcrpn56CEN8nrp26VIhoFWBzK/Jbgc4lpLnmBABP?=
 =?us-ascii?Q?3k6VvxjQUHDxXVUtj9zUITzPg9vn+ptegTJxM00ZS8ZZnykEMAeJS3LikQPM?=
 =?us-ascii?Q?SPLoNOxkfinug6jyiXfe/al6ajxSpTIweut0m3kxCtGOYpCHHrFAwK635uRn?=
 =?us-ascii?Q?wQloGie7Wno+ZMEKRAHQAcVwA9RcYx4DTHV7BBxpBHl6CDFDAuyV3ywXTE2J?=
 =?us-ascii?Q?jB2efWc9rbnsIkDflnCSFeL0PYxFjuhf198T38eP6ePnSVvPy1KQW0eevmxL?=
 =?us-ascii?Q?DZZy9Ip5W0KK3ofuVLidMmAriRyj9+TJUtGon39erhEkjnLzUGTftejHepZi?=
 =?us-ascii?Q?Bb4cXR6LdYNcTUxANPxBEBCWoUEE+HNDqybAvDeheLqXsoIa9nTe8HFWv1A5?=
 =?us-ascii?Q?U+EC051/DBySaf/lEYx/XwEEM5a9dUT4/PaY0FPvaNYtj3ypf8Ef9qCQnTVL?=
 =?us-ascii?Q?W5k6zZONsQrPU6VkUgkKeuj3jx2kZ9GH3O37FUPZVLJMnajB8n3bBnlmiVZs?=
 =?us-ascii?Q?uSFEXFcgWAQ5jY4zotKSon3j+7Qk962SrM6/SGCSRj6ZmAgNzSf1Pfl9K7xn?=
 =?us-ascii?Q?Q3A9MbWeTXqoVDe/qJ4nqaJSjBRxfgyhMpuLqm/sHNI7+yt5f3tUmJZW8Rq7?=
 =?us-ascii?Q?vMXYF/12vZcFHSP20H4QtI0DDELU8Ao=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3c57a2fa-d5cb-4427-902e-08da2f40baa6
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 May 2022 09:13:48.3486
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: NpxSrv9ZlyPkhKqqal5XYa6LIRos+jZ96HxuODByLTiJ3MtiTKl0ofdy3txo/6ZVClt4y0paZspBHvt7b/Ma6tQ5PV3f7ZRsTVaEXxv9VWs=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR10MB3388
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.858
 definitions=2022-05-06_03:2022-05-05,2022-05-06 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 bulkscore=0 malwarescore=0
 spamscore=0 mlxlogscore=806 mlxscore=0 suspectscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2202240000
 definitions=main-2205060050
X-Proofpoint-GUID: 1wUKhEZbXeLw-OU_hI8hrv8Vxjy_Tkfi
X-Proofpoint-ORIG-GUID: 1wUKhEZbXeLw-OU_hI8hrv8Vxjy_Tkfi
X-Spam-Status: No, score=-0.3 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE,
	URIBL_BLACK autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Ever since commit 78a5255ffb6a ("Stop the ad-hoc games with
-Wno-maybe-initialized"), GCC's uninitialized variable warnings have
been disabled by default.  Now, you have to turn on W=1 or W=2 to see
the warnings which nobody except Arnd does.

Disabling that has lead to a bunch of embarrassing bugs where variables
are *never* initialized.  Very unsubtle bugs.  The bugs doesn't reach
users because Nathan Chancellor and I review Clang and Smatch warnings
respectively.  Also the kbuild-bot reports uninitialized variables.

It's a lot to deal with.  Uninitialized variable bugs are probably the
most common bug I have to deal with.

It's frustrating.  Sometimes the false positives are hard to analyse
because I have to read through multiple functions.  A lot of times
when I write a patch and a commit message Nathan has already fixed it
so it's just a waste of time.

It's risky as well.  The Smatch check for uninitialized variables was
broken for most of 2021.  Nathan sometimes goes on vacation.

I guess I would hope that one day we can turn on the GCC uninitialized
variable warnings again.  That would mean silencing false positives
which a lot of people don't want to do...  Maybe Clang has fewer false
positives than GCC?

The Smatch check for uninitialized variable was deliberately written to
be more strict than GCC because GCC was missing bugs.  So I think
leaving Smatch false positives is fine.  There is a trade off between
fewer false positives and missing bugs and Smatch is meant to err on the
side of finding bugs but with the cost of false positives.

Most of the Smatch uninitialized false positives are caused by loops:

	int i, ret;

	for (i = 0; i < bytes; i++) { // <-- what if bytes is zero?
		if (...)
			continue; // <-- can every iteration hit continue?
		ret = frob();
	}

	return ret;

There is also stuff like this which is harmless:

	uint val;

	ret = read(&val);
	*p = val;  // <-- uninitialized variable if read() fails
	return ret;

Btw, here is how to run Smatch on your code:
https://staticthinking.wordpress.com/2022/04/25/how-to-run-smatch-on-your-code/

regards,
dan carpenter