| Message ID | 20171218180944.3145591-1-ast@kernel.org |
|---|---|
| State | Accepted, archived |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf-next] bpf: arm64: fix uninitialized variable | expand |
On 12/18/2017 07:09 PM, Alexei Starovoitov wrote: > From: Alexei Starovoitov <ast@fb.com> > > fix the following issue: > arch/arm64/net/bpf_jit_comp.c: In function 'bpf_int_jit_compile': > arch/arm64/net/bpf_jit_comp.c:982:18: error: 'image_size' may be used > uninitialized in this function [-Werror=maybe-uninitialized] > > Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") > Reported-by: Arnd Bergmann <arnd@arndb.de> > Signed-off-by: Alexei Starovoitov <ast@kernel.org> > --- > arch/arm64/net/bpf_jit_comp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c > index 396490cf7316..acaa935ed977 100644 > --- a/arch/arm64/net/bpf_jit_comp.c > +++ b/arch/arm64/net/bpf_jit_comp.c > @@ -897,6 +897,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) > image_ptr = jit_data->image; > header = jit_data->header; > extra_pass = true; > + image_size = sizeof(u32) * ctx.idx; > goto skip_init_ctx; > } > memset(&ctx, 0, sizeof(ctx)); > I don't really mind, but it feels more complex than it needs to be imho, since in the initial pass you fetch 'image_size' in fake pass from ctx.idx, then we set ctx.idx to 0 again, do another pass and use the cached ctx.idx from that second pass instead of the first one where we set 'image_size' originally, so we definitely need to take that into consideration in future reviews at least. Thanks, Daniel
On 12/18/17 10:19 AM, Daniel Borkmann wrote: > On 12/18/2017 07:09 PM, Alexei Starovoitov wrote: >> From: Alexei Starovoitov <ast@fb.com> >> >> fix the following issue: >> arch/arm64/net/bpf_jit_comp.c: In function 'bpf_int_jit_compile': >> arch/arm64/net/bpf_jit_comp.c:982:18: error: 'image_size' may be used >> uninitialized in this function [-Werror=maybe-uninitialized] >> >> Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") >> Reported-by: Arnd Bergmann <arnd@arndb.de> >> Signed-off-by: Alexei Starovoitov <ast@kernel.org> >> --- >> arch/arm64/net/bpf_jit_comp.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c >> index 396490cf7316..acaa935ed977 100644 >> --- a/arch/arm64/net/bpf_jit_comp.c >> +++ b/arch/arm64/net/bpf_jit_comp.c >> @@ -897,6 +897,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) >> image_ptr = jit_data->image; >> header = jit_data->header; >> extra_pass = true; >> + image_size = sizeof(u32) * ctx.idx; >> goto skip_init_ctx; >> } >> memset(&ctx, 0, sizeof(ctx)); >> > > I don't really mind, but it feels more complex than it needs to be > imho, since in the initial pass you fetch 'image_size' in fake pass > from ctx.idx, then we set ctx.idx to 0 again, do another pass and > use the cached ctx.idx from that second pass instead of the first > one where we set 'image_size' originally, so we definitely need to > take that into consideration in future reviews at least. not sure what you mean. This check: ctx.idx != jit_data->ctx.idx matters the most. After first alloc the 'image_size' variable used for dumping only. That's why the JITing itself worked fine. We could have removed it since it's computable from idx, but imo it's fine this way.
On 12/18/2017 07:36 PM, Alexei Starovoitov wrote: > On 12/18/17 10:19 AM, Daniel Borkmann wrote: >> On 12/18/2017 07:09 PM, Alexei Starovoitov wrote: >>> From: Alexei Starovoitov <ast@fb.com> >>> >>> fix the following issue: >>> arch/arm64/net/bpf_jit_comp.c: In function 'bpf_int_jit_compile': >>> arch/arm64/net/bpf_jit_comp.c:982:18: error: 'image_size' may be used >>> uninitialized in this function [-Werror=maybe-uninitialized] >>> >>> Fixes: db496944fdaa ("bpf: arm64: add JIT support for multi-function programs") >>> Reported-by: Arnd Bergmann <arnd@arndb.de> >>> Signed-off-by: Alexei Starovoitov <ast@kernel.org> >>> --- >>> arch/arm64/net/bpf_jit_comp.c | 1 + >>> 1 file changed, 1 insertion(+) >>> >>> diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c >>> index 396490cf7316..acaa935ed977 100644 >>> --- a/arch/arm64/net/bpf_jit_comp.c >>> +++ b/arch/arm64/net/bpf_jit_comp.c >>> @@ -897,6 +897,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) >>> image_ptr = jit_data->image; >>> header = jit_data->header; >>> extra_pass = true; >>> + image_size = sizeof(u32) * ctx.idx; >>> goto skip_init_ctx; >>> } >>> memset(&ctx, 0, sizeof(ctx)); >> >> I don't really mind, but it feels more complex than it needs to be >> imho, since in the initial pass you fetch 'image_size' in fake pass >> from ctx.idx, then we set ctx.idx to 0 again, do another pass and >> use the cached ctx.idx from that second pass instead of the first >> one where we set 'image_size' originally, so we definitely need to >> take that into consideration in future reviews at least. > > not sure what you mean. > This check: ctx.idx != jit_data->ctx.idx matters the most. > After first alloc the 'image_size' variable used for dumping only. > That's why the JITing itself worked fine. We could have removed it > since it's computable from idx, but imo it's fine this way. Fair enough, given final ctx.idx value must be guaranteed to never change in future between pass#1 and pass#2 from the first bpf_int_jit_compile() run, then lets go with this smaller version; applied to bpf-next, thanks Alexei!
diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 396490cf7316..acaa935ed977 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -897,6 +897,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) image_ptr = jit_data->image; header = jit_data->header; extra_pass = true; + image_size = sizeof(u32) * ctx.idx; goto skip_init_ctx; } memset(&ctx, 0, sizeof(ctx));