Skip to contentSkip to conversation

compat_ioct: fix bsg SG_IO

SCSI Dan Carpenter 2 participants 3 messages Nov 2, 2011 SCSI

lore
Share & tools
lore
#0 lore raw

84eb8fb42c120 "[SCSI] compat_ioct: fix bsg SG_IO" introduces an uninitialized variable use.

278 static int sg_ioctl_trans(unsigned int fd, unsigned int cmd,
279 sg_io_hdr32_t __user *sgio32)
280 {

   281          sg_io_hdr_t __user *sgio;
   282          u16 iovec_count;
   283          u32 data;
   284          void __user *dxferp;
   285          int err;
   286          int interface_id;
   287  
   288          if (get_user(interface_id, &sgio32->interface_id))
                                            ^^^^^^

sgio32 is unitialized here. Unfortunately Gcc doesn't warn about it.

   289                  return -EFAULT;
   290          if (interface_id != 'S')
   291                  return sys_ioctl(fd, cmd, (unsigned long)sgio32);

regards,
dan carpenter

maintainer
#1 lore raw
Quoted 15 lines · Dan Carpenter

84eb8fb42c120 "[SCSI] compat_ioct: fix bsg SG_IO" introduces an uninitialized variable use.

   278  static int sg_ioctl_trans(unsigned int fd, unsigned int cmd,
   279                          sg_io_hdr32_t __user *sgio32)
   280  {
   281          sg_io_hdr_t __user *sgio;
   282          u16 iovec_count;
   283          u32 data;
   284          void __user *dxferp;
   285          int err;
   286          int interface_id;
   287  
   288          if (get_user(interface_id, &sgio32->interface_id))
                                            ^^^^^^
Quoted 1 line

sgio32 is unitialized here. Unfortunately Gcc doesn't warn about it.

I don't quite understand what makes you think that: it's passed in as an argument to the function. It's a pointer to the userspace 32 bit representation of the structure. The use logic is a slightly convoluted way of saying we only understand the 'S' header but we're going to let the real ioctl routine say what the error is if it's not type 'S'.

James

#2 lore raw
Quoted 18 lines · James Bottomley
Quoted 15 lines · Dan Carpenter

84eb8fb42c120 "[SCSI] compat_ioct: fix bsg SG_IO" introduces an uninitialized variable use.

   278  static int sg_ioctl_trans(unsigned int fd, unsigned int cmd,
   279                          sg_io_hdr32_t __user *sgio32)
   280  {
   281          sg_io_hdr_t __user *sgio;
   282          u16 iovec_count;
   283          u32 data;
   284          void __user *dxferp;
   285          int err;
   286          int interface_id;
   287  
   288          if (get_user(interface_id, &sgio32->interface_id))
                                            ^^^^^^
Quoted 1 line

sgio32 is unitialized here. Unfortunately Gcc doesn't warn about it.

Quoted 5 lines

I don't quite understand what makes you think that: it's passed in as an argument to the function. It's a pointer to the userspace 32 bit representation of the structure. The use logic is a slightly convoluted way of saying we only understand the 'S' header but we're going to let the real ioctl routine say what the error is if it's not type 'S'.

Uh... This is embarrassing. I got confused between sgio and sgio32.

Sorry for this.

regards,
dan carpenter