Hi,
Static analysis on linux-next with Coverity has identified two issues
with reads of initialized pointers in the following commit:
commit 8d6e90983ade25ec7925211ac31d9ccaf64b7edf
Author: Steven Rostedt (VMware) <rostedt@xxxxxxxxxxx>
Date: Thu Sep 23 22:20:57 2021 -0400
tracing: Create a sparse bitmask for pid filtering
The analysis is as follows:
332 static void pid_list_refill_irq(struct irq_work *iwork)
333 {
1. Condition 0 /* !!(!__builtin_types_compatible_p() &&
!__builtin_types_compatible_p()) */, taking false branch.
334 struct trace_pid_list *pid_list = container_of(iwork, struct
trace_pid_list,
335 refill_irqwork);
2. var_decl: Declaring variable upper without initializer.
336 union upper_chunk *upper;
337 union lower_chunk *lower;
338 union upper_chunk **upper_next = &upper;
339 union lower_chunk **lower_next = &lower;
340 int upper_count;
341 int lower_count;
342 int ucnt = 0;
343 int lcnt = 0;
344
345 again:
346 raw_spin_lock(&pid_list->lock);
347 upper_count = CHUNK_ALLOC - pid_list->free_upper_chunks;
348 lower_count = CHUNK_ALLOC - pid_list->free_lower_chunks;
349 raw_spin_unlock(&pid_list->lock);
350
3. Condition upper_count <= 0, taking false branch.
351 if (upper_count <= 0 && lower_count <= 0)
352 return;
353
4. Condition upper_count-- > 0, taking true branch.
354 while (upper_count-- > 0) {
355 union upper_chunk *chunk;
356
357 chunk = kzalloc(sizeof(*chunk), GFP_KERNEL);
5. Condition !chunk, taking true branch.
358 if (!chunk)
6. Breaking from loop.
359 break;
360 *upper_next = chunk;
361 upper_next = &chunk->next;
362 ucnt++;
363 }
364
7. Condition lower_count-- > 0, taking true branch.
365 while (lower_count-- > 0) {
366 union lower_chunk *chunk;
367
368 chunk = kzalloc(sizeof(*chunk), GFP_KERNEL);
8. Condition !chunk, taking true branch.
369 if (!chunk)
9. Breaking from loop.
370 break;
371 *lower_next = chunk;
372 lower_next = &chunk->next;
373 lcnt++;
374 }
375
376 raw_spin_lock(&pid_list->lock);
Uninitialized pointer read (UNINIT)
10. uninit_use: Using uninitialized value upper.
377 if (upper) {
378 *upper_next = pid_list->upper_list;
379 pid_list->upper_list = upper;
380 pid_list->free_upper_chunks += ucnt;
381 }
Uninitialized pointer read (UNINIT)
11. uninit_use: Using uninitialized value lower.
382 if (lower) {
383 *lower_next = pid_list->lower_list;
384 pid_list->lower_list = lower;
385 pid_list->free_lower_chunks += lcnt;
386 }
387 raw_spin_unlock(&pid_list->lock);
388
Colin
