Commit c6a45ee7 authored by Kevin Brodsky's avatar Kevin Brodsky Committed by Jens Axboe
Browse files

ublk: prevent invalid access with DEBUG 



ublk_ch_uring_cmd_local() may jump to the out label before
initialising the io pointer. This will cause trouble if DEBUG is
defined, because the pr_devel() call dereferences io. Clang reports:

drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
 2403 |         if (tag >= ub->dev_info.queue_depth)
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here
 2492 |                         __func__, cmd_op, tag, ret, io->flags);
      |

Fix this by initialising io to NULL and checking it before
dereferencing it.

Signed-off-by: default avatarKevin Brodsky <kevin.brodsky@arm.com>
Fixes: 71f28f31 ("ublk_drv: add io_uring based userspace block driver")
Reviewed-by: default avatarCaleb Sander Mateos <csander@purestorage.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent a857d992

drivers/block/ublk_drv.c

+2 −2
Original line number Diff line number Diff line
@@ -2301,7 +2301,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, 
	u16 buf_idx = UBLK_INVALID_BUF_IDX;

	struct ublk_device *ub = cmd->file->private_data;

	struct ublk_queue *ubq;

	struct ublk_io *io;

	struct ublk_io *io = NULL;

	u32 cmd_op = cmd->cmd_op;

	u16 q_id = READ_ONCE(ub_src->q_id);

	u16 tag = READ_ONCE(ub_src->tag);
@@ -2422,7 +2422,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd, 


 out:

	pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n",

			__func__, cmd_op, tag, ret, io->flags);

			__func__, cmd_op, tag, ret, io ? io->flags : 0);

	return ret;

}