drivers/block/ublk_drv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
ublk_ch_uring_cmd_local() may jump to the out label before
initialising the io pointer. This will cause trouble if DEBUG is
defined, because the pr_devel() call dereferences io. Clang reports:
drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
2403 | if (tag >= ub->dev_info.queue_depth)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here
2492 | __func__, cmd_op, tag, ret, io->flags);
|
Fix this by initialising io to NULL and checking it before
dereferencing it.
Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
---
Cc: Ali Utku Selen <ali.utku.selen@arm.com>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>
---
drivers/block/ublk_drv.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 0c74a41a6753..359564c40cb5 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2367,7 +2367,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
u16 buf_idx = UBLK_INVALID_BUF_IDX;
struct ublk_device *ub = cmd->file->private_data;
struct ublk_queue *ubq;
- struct ublk_io *io;
+ struct ublk_io *io = NULL;
u32 cmd_op = cmd->cmd_op;
u16 q_id = READ_ONCE(ub_src->q_id);
u16 tag = READ_ONCE(ub_src->tag);
@@ -2488,7 +2488,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
out:
pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n",
- __func__, cmd_op, tag, ret, io->flags);
+ __func__, cmd_op, tag, ret, io ? io->flags : 0);
return ret;
}
base-commit: ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d
--
2.51.2On Wed, Nov 26, 2025 at 8:49 PM Kevin Brodsky <kevin.brodsky@arm.com> wrote: > > ublk_ch_uring_cmd_local() may jump to the out label before > initialising the io pointer. This will cause trouble if DEBUG is > defined, because the pr_devel() call dereferences io. Clang reports: > > drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized] > 2403 | if (tag >= ub->dev_info.queue_depth) > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here > 2492 | __func__, cmd_op, tag, ret, io->flags); > | > > Fix this by initialising io to NULL and checking it before > dereferencing it. > > Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com> > --- > Cc: Ali Utku Selen <ali.utku.selen@arm.com> > Cc: Ming Lei <ming.lei@redhat.com> > Cc: Jens Axboe <axboe@kernel.dk> Reviewed-by: Ming Lei <ming.lei@redhat.com>
On Wed, 26 Nov 2025 12:48:35 +0000, Kevin Brodsky wrote:
> ublk_ch_uring_cmd_local() may jump to the out label before
> initialising the io pointer. This will cause trouble if DEBUG is
> defined, because the pr_devel() call dereferences io. Clang reports:
>
> drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
> 2403 | if (tag >= ub->dev_info.queue_depth)
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here
> 2492 | __func__, cmd_op, tag, ret, io->flags);
> |
>
> [...]
Applied, thanks!
[1/1] ublk: prevent invalid access with DEBUG
(no commit info)
Best regards,
--
Jens Axboe
On Wed, Nov 26, 2025 at 4:48 AM Kevin Brodsky <kevin.brodsky@arm.com> wrote:
>
> ublk_ch_uring_cmd_local() may jump to the out label before
> initialising the io pointer. This will cause trouble if DEBUG is
> defined, because the pr_devel() call dereferences io. Clang reports:
>
> drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
> 2403 | if (tag >= ub->dev_info.queue_depth)
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here
> 2492 | __func__, cmd_op, tag, ret, io->flags);
> |
>
> Fix this by initialising io to NULL and checking it before
> dereferencing it.
>
> Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
Looks like this could use a Fixes tag:
Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
Other than that,
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
> ---
> Cc: Ali Utku Selen <ali.utku.selen@arm.com>
> Cc: Ming Lei <ming.lei@redhat.com>
> Cc: Jens Axboe <axboe@kernel.dk>
> ---
> drivers/block/ublk_drv.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 0c74a41a6753..359564c40cb5 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -2367,7 +2367,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
> u16 buf_idx = UBLK_INVALID_BUF_IDX;
> struct ublk_device *ub = cmd->file->private_data;
> struct ublk_queue *ubq;
> - struct ublk_io *io;
> + struct ublk_io *io = NULL;
> u32 cmd_op = cmd->cmd_op;
> u16 q_id = READ_ONCE(ub_src->q_id);
> u16 tag = READ_ONCE(ub_src->tag);
> @@ -2488,7 +2488,7 @@ static int ublk_ch_uring_cmd_local(struct io_uring_cmd *cmd,
>
> out:
> pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n",
> - __func__, cmd_op, tag, ret, io->flags);
> + __func__, cmd_op, tag, ret, io ? io->flags : 0);
> return ret;
> }
>
>
> base-commit: ac3fd01e4c1efce8f2c054cdeb2ddd2fc0fb150d
> --
> 2.51.2
>
>
© 2016 - 2025 Red Hat, Inc.