On Thu, Sep 18, 2025 at 06:34:55PM -0400, Xin Long wrote:
...
quoted hunk ↗ jump to hunk
diff --git a/net/quic/stream.c b/net/quic/stream.c
...
quoted hunk ↗ jump to hunk
+/* Create and register new streams for sending. */
+static struct quic_stream *quic_stream_send_create(struct quic_stream_table *streams,
+ s64 max_stream_id, u8 is_serv)
+{
+ struct quic_stream *stream;
+ s64 stream_id;
+
+ stream_id = streams->send.next_bidi_stream_id;
+ if (quic_stream_id_uni(max_stream_id))
+ stream_id = streams->send.next_uni_stream_id;
+
+ /* rfc9000#section-2.1: A stream ID that is used out of order results in all streams
+ * of that type with lower-numbered stream IDs also being opened.
+ */
+ while (stream_id <= max_stream_id) {
+ stream = kzalloc(sizeof(*stream), GFP_KERNEL);
+ if (!stream)
+ return NULL;
...
+ }
+ return stream;
Hi Xin,
I'm unsure if can happen - actually I doubt it can - but
if the loop above iterates zero times then stream will be used
uninitialised here.
Likewise in quic_stream_recv_create().
Flagged by Smatch
...