Commit caf82f72 authored by Arnd Bergmann's avatar Arnd Bergmann Committed by Greg Kroah-Hartman
Browse files

visorbus: fix uninitialized variable access 



The setup_crash_devices_work_queue function only partially initializes
the message it sends to chipset_init, leading to undefined behavior:

drivers/visorbus/visorchipset.c: In function 'setup_crash_devices_work_queue':
drivers/visorbus/visorchipset.c:333:6: error: '((unsigned char*)&msg.hdr.flags)[0]' is used uninitialized in this function [-Werror=uninitialized]
  if (inmsg->hdr.flags.response_expected)

Set up the entire structure, zero-initializing the 'response_expected'
flag.

This was apparently found by the patch that added the -O3 build option
in Kconfig.

Fixes: 12e364b9 ("staging: visorchipset driver to provide registration and other services")
Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20200107202950.782951-1-arnd@arndb.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 34bc4f46

drivers/visorbus/visorchipset.c

+7 −4
Original line number Diff line number Diff line
@@ -1210,14 +1210,17 @@ static void setup_crash_devices_work_queue(struct work_struct *work) 
{

	struct controlvm_message local_crash_bus_msg;

	struct controlvm_message local_crash_dev_msg;

	struct controlvm_message msg;

	struct controlvm_message msg = {

		.hdr.id = CONTROLVM_CHIPSET_INIT,

		.cmd.init_chipset = {

			.bus_count = 23,

			.switch_count = 0,

		},

	};

	u32 local_crash_msg_offset;

	u16 local_crash_msg_count;



	/* send init chipset msg */

	msg.hdr.id = CONTROLVM_CHIPSET_INIT;

	msg.cmd.init_chipset.bus_count = 23;

	msg.cmd.init_chipset.switch_count = 0;

	chipset_init(&msg);

	/* get saved message count */

	if (visorchannel_read(chipset_dev->controlvm_channel,