diff mbox

[2/2] mm: Initialize error in shmem_file_aio_read()

Message ID 1397414783-28098-2-git-send-email-geert@linux-m68k.org (mailing list archive)
State New, archived
Headers show

Commit Message

Geert Uytterhoeven April 13, 2014, 6:46 p.m. UTC
mm/shmem.c: In function ‘shmem_file_aio_read’:
mm/shmem.c:1414: warning: ‘error’ may be used uninitialized in this function

If the loop is aborted during the first iteration by one of the two first
break statements, error will be uninitialized.

Introduced by commit 6e58e79db8a16222b31fc8da1ca2ac2dccfc4237
("introduce copy_page_to_iter, kill loop over iovec in
generic_file_aio_read()").

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
---
The code is too complex to see if this is an obvious false positive.

 mm/shmem.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Al Viro April 13, 2014, 8:50 p.m. UTC | #1
On Sun, Apr 13, 2014 at 08:46:22PM +0200, Geert Uytterhoeven wrote:
> mm/shmem.c: In function ‘shmem_file_aio_read’:
> mm/shmem.c:1414: warning: ‘error’ may be used uninitialized in this function
> 
> If the loop is aborted during the first iteration by one of the two first
> break statements, error will be uninitialized.
> 
> Introduced by commit 6e58e79db8a16222b31fc8da1ca2ac2dccfc4237
> ("introduce copy_page_to_iter, kill loop over iovec in
> generic_file_aio_read()").
> 
> Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
> ---
> The code is too complex to see if this is an obvious false positive.

Good catch; sadly, it *can* be triggered - read() starting past the EOF
will step into it.  Applied, will push today.
--
To unsubscribe from this list: send the line "unsubscribe linux-cifs" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/mm/shmem.c b/mm/shmem.c
index 8f1a95406bae..9f70e02111c6 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1411,7 +1411,7 @@  static ssize_t shmem_file_aio_read(struct kiocb *iocb,
 	pgoff_t index;
 	unsigned long offset;
 	enum sgp_type sgp = SGP_READ;
-	int error;
+	int error = 0;
 	ssize_t retval;
 	size_t count;
 	loff_t *ppos = &iocb->ki_pos;