On Wed, Jun 17, 2020 at 01:08:44PM -0700, Nathan Chancellor wrote:

On Mon, Jun 01, 2020 at 04:25:32AM -0700, Sargun Dhillon wrote:

quoted

[...]
 static long seccomp_notify_recv(struct seccomp_filter *filter,
 				void __user *buf)
 {
-	struct seccomp_knotif *knotif = NULL, *cur;
+	struct seccomp_knotif *knotif, *cur;
 	struct seccomp_notif unotif;
 	ssize_t ret;
 

I don't know that this should have been removed, clang now warns:

kernel/seccomp.c:1063:2: warning: variable 'knotif' is used uninitialized whenever 'for' loop exits because its condition is false [-Wsometimes-uninitialized]
        list_for_each_entry(cur, &filter->notif->notifications, list) {
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/list.h:602:7: note: expanded from macro 'list_for_each_entry'
             &pos->member != (head);                                    \
             ^~~~~~~~~~~~~~~~~~~~~~
kernel/seccomp.c:1075:7: note: uninitialized use occurs here
        if (!knotif) {
             ^~~~~~
kernel/seccomp.c:1063:2: note: remove the condition if it is always true
        list_for_each_entry(cur, &filter->notif->notifications, list) {
        ^
include/linux/list.h:602:7: note: expanded from macro 'list_for_each_entry'
             &pos->member != (head);                                    \
             ^
kernel/seccomp.c:1045:31: note: initialize the variable 'knotif' to silence this warning
        struct seccomp_knotif *knotif, *cur;
                                     ^
                                      = NULL
1 warning generated.

Eek; yes, thank you! I've folded the fix into Sargun's patch.

-- 
Kees Cook