ublk: prevent invalid access with DEBUG

[ Upstream commit c6a45ee7607de3a350008630f4369b1b5ac80884 ]

ublk_ch_uring_cmd_local() may jump to the out label before
initialising the io pointer. This will cause trouble if DEBUG is
defined, because the pr_devel() call dereferences io. Clang reports:

drivers/block/ublk_drv.c:2403:6: error: variable 'io' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
 2403 |         if (tag >= ub->dev_info.queue_depth)
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/block/ublk_drv.c:2492:32: note: uninitialized use occurs here
 2492 |                         __func__, cmd_op, tag, ret, io->flags);
      |

Fix this by initialising io to NULL and checking it before
dereferencing it.

Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver")
Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index defcc964ecab656033b1a4f31018d737f719c446..b874cb84bad95e5d6da874436bf53ea68113390a 100644 (file)
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1768,7 +1768,7 @@ static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd,
 {
        struct ublk_device *ub = cmd->file->private_data;
        struct ublk_queue *ubq;
-       struct ublk_io *io;
+       struct ublk_io *io = NULL;
        u32 cmd_op = cmd->cmd_op;
        unsigned tag = ub_cmd->tag;
        int ret = -EINVAL;
@@ -1882,7 +1882,7 @@ static int __ublk_ch_uring_cmd(struct io_uring_cmd *cmd,
 
  out:
        pr_devel("%s: complete: cmd op %d, tag %d ret %x io_flags %x\n",
-                       __func__, cmd_op, tag, ret, io->flags);
+                       __func__, cmd_op, tag, ret, io ? io->flags : 0);
        return ret;
 }