Re: ifq: ifq_dec_sleep may return garbage

[David Gwynne]

On Tue, Mar 10, 2020 at 12:03:24AM +0100, Tobias Heider wrote:
> If 'm = ifq->ifq_ops->ifqop_deq_begin(ifq, &cookie)' is not NULL
> the loop is exited and an uninitialized 'int error' is returned.
> Several lines below error is checked for '!= 0', so i assume it
> was meant to be initialized to '0'. 
> 
> ok?

ok

> 
> Index: ifq.c
> ===
> RCS file: /mount/openbsd/cvs/src/sys/net/ifq.c,v
> retrieving revision 1.36
> diff -u -p -r1.36 ifq.c
> --- ifq.c 25 Jan 2020 06:31:32 -  1.36
> +++ ifq.c 9 Mar 2020 22:57:58 -
> @@ -395,7 +395,7 @@ ifq_deq_sleep(struct ifqueue *ifq, struc
>  {
>   struct mbuf *m;
>   void *cookie;
> - int error;
> + int error = 0;
>  
>   ifq_deq_enter(ifq);
>   if (ifq->ifq_len == 0 && nbio)

ifq: ifq_dec_sleep may return garbage

[Tobias Heider]

If 'm = ifq->ifq_ops->ifqop_deq_begin(ifq, &cookie)' is not NULL
the loop is exited and an uninitialized 'int error' is returned.
Several lines below error is checked for '!= 0', so i assume it
was meant to be initialized to '0'. 

ok?

Index: ifq.c
===
RCS file: /mount/openbsd/cvs/src/sys/net/ifq.c,v
retrieving revision 1.36
diff -u -p -r1.36 ifq.c
--- ifq.c   25 Jan 2020 06:31:32 -  1.36
+++ ifq.c   9 Mar 2020 22:57:58 -
@@ -395,7 +395,7 @@ ifq_deq_sleep(struct ifqueue *ifq, struc
 {
struct mbuf *m;
void *cookie;
-   int error;
+   int error = 0;
 
ifq_deq_enter(ifq);
if (ifq->ifq_len == 0 && nbio)