compat_ioct: fix bsg SG_IO
84eb8fb42c120 "[SCSI] compat_ioct: fix bsg SG_IO" introduces an uninitialized variable use.
278 static int sg_ioctl_trans(unsigned int fd, unsigned int cmd,
279 sg_io_hdr32_t __user *sgio32)
280 {
281 sg_io_hdr_t __user *sgio;
282 u16 iovec_count;
283 u32 data;
284 void __user *dxferp;
285 int err;
286 int interface_id;
287
288 if (get_user(interface_id, &sgio32->interface_id))
^^^^^^sgio32 is unitialized here. Unfortunately Gcc doesn't warn about it.
289 return -EFAULT; 290 if (interface_id != 'S') 291 return sys_ioctl(fd, cmd, (unsigned long)sgio32);
regards,
dan carpenter
James Bottomley
maintainerQuoted 15 lines · Dan Carpenter
84eb8fb42c120"[SCSI]compat_ioct: fix bsgSG_IO" introduces an uninitialized variable use.278 static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, 279 sg_io_hdr32_t __user *sgio32) 280 { 281 sg_io_hdr_t __user *sgio; 282 u16 iovec_count; 283 u32 data; 284 void __user *dxferp; 285 int err; 286 int interface_id; 287 288 if (get_user(interface_id, &sgio32->interface_id)) ^^^^^^
Quoted 1 line
sgio32 is unitialized here. Unfortunately Gcc doesn't warn about it.
I don't quite understand what makes you think that: it's passed in as an argument to the function. It's a pointer to the userspace 32 bit representation of the structure. The use logic is a slightly convoluted way of saying we only understand the 'S' header but we're going to let the real ioctl routine say what the error is if it's not type 'S'.
James
Quoted 18 lines · James Bottomley
Quoted 15 lines · Dan Carpenter
84eb8fb42c120"[SCSI]compat_ioct: fix bsgSG_IO" introduces an uninitialized variable use.278 static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, 279 sg_io_hdr32_t __user *sgio32) 280 { 281 sg_io_hdr_t __user *sgio; 282 u16 iovec_count; 283 u32 data; 284 void __user *dxferp; 285 int err; 286 int interface_id; 287 288 if (get_user(interface_id, &sgio32->interface_id)) ^^^^^^Quoted 1 line
sgio32 is unitialized here. Unfortunately Gcc doesn't warn about it.
Quoted 5 lines
I don't quite understand what makes you think that: it's passed in as an argument to the function. It's a pointer to the userspace 32 bit representation of the structure. The use logic is a slightly convoluted way of saying we only understand the 'S' header but we're going to let the real ioctl routine say what the error is if it's not type 'S'.
Uh... This is embarrassing. I got confused between sgio and sgio32.
Sorry for this.
regards,
dan carpenter