| From 04f3a0693ce9e776d9dbf0e1a35659a1c24311ca Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 7 Jan 2020 21:29:40 +0100 |
| Subject: visorbus: fix uninitialized variable access |
| |
| From: Arnd Bergmann <arnd@arndb.de> |
| |
| [ Upstream commit caf82f727e69b647f09d57a1fc56e69d22a5f483 ] |
| |
| The setup_crash_devices_work_queue function only partially initializes |
| the message it sends to chipset_init, leading to undefined behavior: |
| |
| drivers/visorbus/visorchipset.c: In function 'setup_crash_devices_work_queue': |
| drivers/visorbus/visorchipset.c:333:6: error: '((unsigned char*)&msg.hdr.flags)[0]' is used uninitialized in this function [-Werror=uninitialized] |
| if (inmsg->hdr.flags.response_expected) |
| |
| Set up the entire structure, zero-initializing the 'response_expected' |
| flag. |
| |
| This was apparently found by the patch that added the -O3 build option |
| in Kconfig. |
| |
| Fixes: 12e364b9f08a ("staging: visorchipset driver to provide registration and other services") |
| Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
| Link: https://lore.kernel.org/r/20200107202950.782951-1-arnd@arndb.de |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/visorbus/visorchipset.c | 11 +++++++---- |
| 1 file changed, 7 insertions(+), 4 deletions(-) |
| |
| diff --git a/drivers/visorbus/visorchipset.c b/drivers/visorbus/visorchipset.c |
| index ca752b8f495fa..cb1eb7e05f871 100644 |
| --- a/drivers/visorbus/visorchipset.c |
| +++ b/drivers/visorbus/visorchipset.c |
| @@ -1210,14 +1210,17 @@ static void setup_crash_devices_work_queue(struct work_struct *work) |
| { |
| struct controlvm_message local_crash_bus_msg; |
| struct controlvm_message local_crash_dev_msg; |
| - struct controlvm_message msg; |
| + struct controlvm_message msg = { |
| + .hdr.id = CONTROLVM_CHIPSET_INIT, |
| + .cmd.init_chipset = { |
| + .bus_count = 23, |
| + .switch_count = 0, |
| + }, |
| + }; |
| u32 local_crash_msg_offset; |
| u16 local_crash_msg_count; |
| |
| /* send init chipset msg */ |
| - msg.hdr.id = CONTROLVM_CHIPSET_INIT; |
| - msg.cmd.init_chipset.bus_count = 23; |
| - msg.cmd.init_chipset.switch_count = 0; |
| chipset_init(&msg); |
| /* get saved message count */ |
| if (visorchannel_read(chipset_dev->controlvm_channel, |
| -- |
| 2.20.1 |
| |