Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

visorbus: fix uninitialized variable access

The setup_crash_devices_work_queue function only partially initializes
the message it sends to chipset_init, leading to undefined behavior:

drivers/visorbus/visorchipset.c: In function 'setup_crash_devices_work_queue':
drivers/visorbus/visorchipset.c:333:6: error: '((unsigned char*)&msg.hdr.flags)[0]' is used uninitialized in this function [-Werror=uninitialized]
if (inmsg->hdr.flags.response_expected)

Set up the entire structure, zero-initializing the 'response_expected'
flag.

This was apparently found by the patch that added the -O3 build option
in Kconfig.

Fixes: 12e364b9f08a ("staging: visorchipset driver to provide registration and other services")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20200107202950.782951-1-arnd@arndb.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Arnd Bergmann and committed by
Greg Kroah-Hartman
caf82f72 34bc4f46

+7 -4
+7 -4
drivers/visorbus/visorchipset.c
··· 1210 1210 { 1211 1211 struct controlvm_message local_crash_bus_msg; 1212 1212 struct controlvm_message local_crash_dev_msg; 1213 - struct controlvm_message msg; 1213 + struct controlvm_message msg = { 1214 + .hdr.id = CONTROLVM_CHIPSET_INIT, 1215 + .cmd.init_chipset = { 1216 + .bus_count = 23, 1217 + .switch_count = 0, 1218 + }, 1219 + }; 1214 1220 u32 local_crash_msg_offset; 1215 1221 u16 local_crash_msg_count; 1216 1222 1217 1223 /* send init chipset msg */ 1218 - msg.hdr.id = CONTROLVM_CHIPSET_INIT; 1219 - msg.cmd.init_chipset.bus_count = 23; 1220 - msg.cmd.init_chipset.switch_count = 0; 1221 1224 chipset_init(&msg); 1222 1225 /* get saved message count */ 1223 1226 if (visorchannel_read(chipset_dev->controlvm_channel,