| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Sat, 11 Nov 2023 14:37:09 +0800
From: kernel test robot <lkp@...el.com>
To: Bragatheswaran Manickavel <bragathemanick0908@...il.com>,
ralf@...ux-mips.org, davem@...emloft.net, edumazet@...gle.com,
kuba@...nel.org, pabeni@...hat.com
Cc: llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev,
Bragatheswaran Manickavel <bragathemanick0908@...il.com>,
linux-hams@...r.kernel.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org,
syzbot+0145ea560de205bc09f0@...kaller.appspotmail.com
Subject: Re: [PATCH] net: memory leak in nr_rx_frame
Hi Bragatheswaran,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master horms-ipvs/master v6.6 next-20231110]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Bragatheswaran-Manickavel/net-memory-leak-in-nr_rx_frame/20231111-013821
base: net-next/main
patch link: https://lore.kernel.org/r/20231110173632.2511-1-bragathemanick0908%40gmail.com
patch subject: [PATCH] net: memory leak in nr_rx_frame
config: powerpc64-allyesconfig (https://download.01.org/0day-ci/archive/20231111/202311111418.ojyVQuqO-lkp@intel.com/config)
compiler: clang version 17.0.0 (https://github.com/llvm/llvm-project.git 4a5ac14ee968ff0ad5d2cc1ffa0299048db4c88a)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231111/202311111418.ojyVQuqO-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202311111418.ojyVQuqO-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> net/netrom/af_netrom.c:968:6: warning: variable 'make' is used uninitialized whenever '||' condition is true [-Wsometimes-uninitialized]
968 | if (sk == NULL || sk_acceptq_is_full(sk) ||
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
net/netrom/af_netrom.c:973:7: note: uninitialized use occurs here
973 | if (make)
| ^~~~
net/netrom/af_netrom.c:968:6: note: remove the '||' if its condition is always false
968 | if (sk == NULL || sk_acceptq_is_full(sk) ||
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> net/netrom/af_netrom.c:968:6: warning: variable 'make' is used uninitialized whenever '||' condition is true [-Wsometimes-uninitialized]
968 | if (sk == NULL || sk_acceptq_is_full(sk) ||
| ^~~~~~~~~~
net/netrom/af_netrom.c:973:7: note: uninitialized use occurs here
973 | if (make)
| ^~~~
net/netrom/af_netrom.c:968:6: note: remove the '||' if its condition is always false
968 | if (sk == NULL || sk_acceptq_is_full(sk) ||
| ^~~~~~~~~~~~~
net/netrom/af_netrom.c:874:19: note: initialize the variable 'make' to silence this warning
874 | struct sock *make;
| ^
| = NULL
2 warnings generated.
vim +968 net/netrom/af_netrom.c
^1da177e4c3f41 Linus Torvalds 2005-04-16 870
^1da177e4c3f41 Linus Torvalds 2005-04-16 871 int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
^1da177e4c3f41 Linus Torvalds 2005-04-16 872 {
^1da177e4c3f41 Linus Torvalds 2005-04-16 873 struct sock *sk;
^1da177e4c3f41 Linus Torvalds 2005-04-16 874 struct sock *make;
^1da177e4c3f41 Linus Torvalds 2005-04-16 875 struct nr_sock *nr_make;
^1da177e4c3f41 Linus Torvalds 2005-04-16 876 ax25_address *src, *dest, *user;
^1da177e4c3f41 Linus Torvalds 2005-04-16 877 unsigned short circuit_index, circuit_id;
^1da177e4c3f41 Linus Torvalds 2005-04-16 878 unsigned short peer_circuit_index, peer_circuit_id;
^1da177e4c3f41 Linus Torvalds 2005-04-16 879 unsigned short frametype, flags, window, timeout;
^1da177e4c3f41 Linus Torvalds 2005-04-16 880 int ret;
^1da177e4c3f41 Linus Torvalds 2005-04-16 881
c8c8218ec5af5d Cong Wang 2019-06-27 882 skb_orphan(skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 883
^1da177e4c3f41 Linus Torvalds 2005-04-16 884 /*
^1da177e4c3f41 Linus Torvalds 2005-04-16 885 * skb->data points to the netrom frame start
^1da177e4c3f41 Linus Torvalds 2005-04-16 886 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 887
^1da177e4c3f41 Linus Torvalds 2005-04-16 888 src = (ax25_address *)(skb->data + 0);
^1da177e4c3f41 Linus Torvalds 2005-04-16 889 dest = (ax25_address *)(skb->data + 7);
^1da177e4c3f41 Linus Torvalds 2005-04-16 890
^1da177e4c3f41 Linus Torvalds 2005-04-16 891 circuit_index = skb->data[15];
^1da177e4c3f41 Linus Torvalds 2005-04-16 892 circuit_id = skb->data[16];
^1da177e4c3f41 Linus Torvalds 2005-04-16 893 peer_circuit_index = skb->data[17];
^1da177e4c3f41 Linus Torvalds 2005-04-16 894 peer_circuit_id = skb->data[18];
^1da177e4c3f41 Linus Torvalds 2005-04-16 895 frametype = skb->data[19] & 0x0F;
^1da177e4c3f41 Linus Torvalds 2005-04-16 896 flags = skb->data[19] & 0xF0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 897
^1da177e4c3f41 Linus Torvalds 2005-04-16 898 /*
^1da177e4c3f41 Linus Torvalds 2005-04-16 899 * Check for an incoming IP over NET/ROM frame.
^1da177e4c3f41 Linus Torvalds 2005-04-16 900 */
98a82febb63404 Ralf Baechle 2005-08-24 901 if (frametype == NR_PROTOEXT &&
98a82febb63404 Ralf Baechle 2005-08-24 902 circuit_index == NR_PROTO_IP && circuit_id == NR_PROTO_IP) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 903 skb_pull(skb, NR_NETWORK_LEN + NR_TRANSPORT_LEN);
badff6d01a8589 Arnaldo Carvalho de Melo 2007-03-13 904 skb_reset_transport_header(skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 905
^1da177e4c3f41 Linus Torvalds 2005-04-16 906 return nr_rx_ip(skb, dev);
^1da177e4c3f41 Linus Torvalds 2005-04-16 907 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 908
^1da177e4c3f41 Linus Torvalds 2005-04-16 909 /*
^1da177e4c3f41 Linus Torvalds 2005-04-16 910 * Find an existing socket connection, based on circuit ID, if it's
^1da177e4c3f41 Linus Torvalds 2005-04-16 911 * a Connect Request base it on their circuit ID.
^1da177e4c3f41 Linus Torvalds 2005-04-16 912 *
^1da177e4c3f41 Linus Torvalds 2005-04-16 913 * Circuit ID 0/0 is not valid but it could still be a "reset" for a
^1da177e4c3f41 Linus Torvalds 2005-04-16 914 * circuit that no longer exists at the other end ...
^1da177e4c3f41 Linus Torvalds 2005-04-16 915 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 916
^1da177e4c3f41 Linus Torvalds 2005-04-16 917 sk = NULL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 918
^1da177e4c3f41 Linus Torvalds 2005-04-16 919 if (circuit_index == 0 && circuit_id == 0) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 920 if (frametype == NR_CONNACK && flags == NR_CHOKE_FLAG)
^1da177e4c3f41 Linus Torvalds 2005-04-16 921 sk = nr_find_peer(peer_circuit_index, peer_circuit_id, src);
^1da177e4c3f41 Linus Torvalds 2005-04-16 922 } else {
^1da177e4c3f41 Linus Torvalds 2005-04-16 923 if (frametype == NR_CONNREQ)
^1da177e4c3f41 Linus Torvalds 2005-04-16 924 sk = nr_find_peer(circuit_index, circuit_id, src);
^1da177e4c3f41 Linus Torvalds 2005-04-16 925 else
^1da177e4c3f41 Linus Torvalds 2005-04-16 926 sk = nr_find_socket(circuit_index, circuit_id);
^1da177e4c3f41 Linus Torvalds 2005-04-16 927 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 928
^1da177e4c3f41 Linus Torvalds 2005-04-16 929 if (sk != NULL) {
7314f5480f3e37 Cong Wang 2018-12-29 930 bh_lock_sock(sk);
badff6d01a8589 Arnaldo Carvalho de Melo 2007-03-13 931 skb_reset_transport_header(skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 932
^1da177e4c3f41 Linus Torvalds 2005-04-16 933 if (frametype == NR_CONNACK && skb->len == 22)
^1da177e4c3f41 Linus Torvalds 2005-04-16 934 nr_sk(sk)->bpqext = 1;
^1da177e4c3f41 Linus Torvalds 2005-04-16 935 else
^1da177e4c3f41 Linus Torvalds 2005-04-16 936 nr_sk(sk)->bpqext = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 937
^1da177e4c3f41 Linus Torvalds 2005-04-16 938 ret = nr_process_rx_frame(sk, skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 939 bh_unlock_sock(sk);
7314f5480f3e37 Cong Wang 2018-12-29 940 sock_put(sk);
^1da177e4c3f41 Linus Torvalds 2005-04-16 941 return ret;
^1da177e4c3f41 Linus Torvalds 2005-04-16 942 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 943
^1da177e4c3f41 Linus Torvalds 2005-04-16 944 /*
^1da177e4c3f41 Linus Torvalds 2005-04-16 945 * Now it should be a CONNREQ.
^1da177e4c3f41 Linus Torvalds 2005-04-16 946 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 947 if (frametype != NR_CONNREQ) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 948 /*
^1da177e4c3f41 Linus Torvalds 2005-04-16 949 * Here it would be nice to be able to send a reset but
e21ce8c7c013fb Ralf Baechle 2005-09-12 950 * NET/ROM doesn't have one. We've tried to extend the protocol
e21ce8c7c013fb Ralf Baechle 2005-09-12 951 * by sending NR_CONNACK | NR_CHOKE_FLAGS replies but that
e21ce8c7c013fb Ralf Baechle 2005-09-12 952 * apparently kills BPQ boxes... :-(
e21ce8c7c013fb Ralf Baechle 2005-09-12 953 * So now we try to follow the established behaviour of
e21ce8c7c013fb Ralf Baechle 2005-09-12 954 * G8PZT's Xrouter which is sending packets with command type 7
e21ce8c7c013fb Ralf Baechle 2005-09-12 955 * as an extension of the protocol.
^1da177e4c3f41 Linus Torvalds 2005-04-16 956 */
e21ce8c7c013fb Ralf Baechle 2005-09-12 957 if (sysctl_netrom_reset_circuit &&
e21ce8c7c013fb Ralf Baechle 2005-09-12 958 (frametype != NR_RESET || flags != 0))
e21ce8c7c013fb Ralf Baechle 2005-09-12 959 nr_transmit_reset(skb, 1);
e21ce8c7c013fb Ralf Baechle 2005-09-12 960
^1da177e4c3f41 Linus Torvalds 2005-04-16 961 return 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 962 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 963
^1da177e4c3f41 Linus Torvalds 2005-04-16 964 sk = nr_find_listener(dest);
^1da177e4c3f41 Linus Torvalds 2005-04-16 965
^1da177e4c3f41 Linus Torvalds 2005-04-16 966 user = (ax25_address *)(skb->data + 21);
^1da177e4c3f41 Linus Torvalds 2005-04-16 967
^1da177e4c3f41 Linus Torvalds 2005-04-16 @968 if (sk == NULL || sk_acceptq_is_full(sk) ||
^1da177e4c3f41 Linus Torvalds 2005-04-16 969 (make = nr_make_new(sk)) == NULL) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 970 nr_transmit_refusal(skb, 0);
^1da177e4c3f41 Linus Torvalds 2005-04-16 971 if (sk)
7314f5480f3e37 Cong Wang 2018-12-29 972 sock_put(sk);
d05be0015c62fa Bragatheswaran Manickavel 2023-11-10 973 if (make)
d05be0015c62fa Bragatheswaran Manickavel 2023-11-10 974 sock_put(make);
^1da177e4c3f41 Linus Torvalds 2005-04-16 975 return 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 976 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 977
7314f5480f3e37 Cong Wang 2018-12-29 978 bh_lock_sock(sk);
7314f5480f3e37 Cong Wang 2018-12-29 979
^1da177e4c3f41 Linus Torvalds 2005-04-16 980 window = skb->data[20];
^1da177e4c3f41 Linus Torvalds 2005-04-16 981
4638faac032756 Cong Wang 2019-07-22 982 sock_hold(make);
^1da177e4c3f41 Linus Torvalds 2005-04-16 983 skb->sk = make;
c8c8218ec5af5d Cong Wang 2019-06-27 984 skb->destructor = sock_efree;
^1da177e4c3f41 Linus Torvalds 2005-04-16 985 make->sk_state = TCP_ESTABLISHED;
^1da177e4c3f41 Linus Torvalds 2005-04-16 986
^1da177e4c3f41 Linus Torvalds 2005-04-16 987 /* Fill in his circuit details */
^1da177e4c3f41 Linus Torvalds 2005-04-16 988 nr_make = nr_sk(make);
^1da177e4c3f41 Linus Torvalds 2005-04-16 989 nr_make->source_addr = *dest;
^1da177e4c3f41 Linus Torvalds 2005-04-16 990 nr_make->dest_addr = *src;
^1da177e4c3f41 Linus Torvalds 2005-04-16 991 nr_make->user_addr = *user;
^1da177e4c3f41 Linus Torvalds 2005-04-16 992
^1da177e4c3f41 Linus Torvalds 2005-04-16 993 nr_make->your_index = circuit_index;
^1da177e4c3f41 Linus Torvalds 2005-04-16 994 nr_make->your_id = circuit_id;
^1da177e4c3f41 Linus Torvalds 2005-04-16 995
^1da177e4c3f41 Linus Torvalds 2005-04-16 996 bh_unlock_sock(sk);
^1da177e4c3f41 Linus Torvalds 2005-04-16 997 circuit = nr_find_next_circuit();
^1da177e4c3f41 Linus Torvalds 2005-04-16 998 bh_lock_sock(sk);
^1da177e4c3f41 Linus Torvalds 2005-04-16 999
^1da177e4c3f41 Linus Torvalds 2005-04-16 1000 nr_make->my_index = circuit / 256;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1001 nr_make->my_id = circuit % 256;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1002
^1da177e4c3f41 Linus Torvalds 2005-04-16 1003 circuit++;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1004
^1da177e4c3f41 Linus Torvalds 2005-04-16 1005 /* Window negotiation */
^1da177e4c3f41 Linus Torvalds 2005-04-16 1006 if (window < nr_make->window)
^1da177e4c3f41 Linus Torvalds 2005-04-16 1007 nr_make->window = window;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1008
^1da177e4c3f41 Linus Torvalds 2005-04-16 1009 /* L4 timeout negotiation */
^1da177e4c3f41 Linus Torvalds 2005-04-16 1010 if (skb->len == 37) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 1011 timeout = skb->data[36] * 256 + skb->data[35];
^1da177e4c3f41 Linus Torvalds 2005-04-16 1012 if (timeout * HZ < nr_make->t1)
^1da177e4c3f41 Linus Torvalds 2005-04-16 1013 nr_make->t1 = timeout * HZ;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1014 nr_make->bpqext = 1;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1015 } else {
^1da177e4c3f41 Linus Torvalds 2005-04-16 1016 nr_make->bpqext = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1017 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 1018
^1da177e4c3f41 Linus Torvalds 2005-04-16 1019 nr_write_internal(make, NR_CONNACK);
^1da177e4c3f41 Linus Torvalds 2005-04-16 1020
^1da177e4c3f41 Linus Torvalds 2005-04-16 1021 nr_make->condition = 0x00;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1022 nr_make->vs = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1023 nr_make->va = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1024 nr_make->vr = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1025 nr_make->vl = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1026 nr_make->state = NR_STATE_3;
18601a7d30c834 Ralf Baechle 2006-07-03 1027 sk_acceptq_added(sk);
^1da177e4c3f41 Linus Torvalds 2005-04-16 1028 skb_queue_head(&sk->sk_receive_queue, skb);
^1da177e4c3f41 Linus Torvalds 2005-04-16 1029
^1da177e4c3f41 Linus Torvalds 2005-04-16 1030 if (!sock_flag(sk, SOCK_DEAD))
676d23690fb62b David S. Miller 2014-04-11 1031 sk->sk_data_ready(sk);
^1da177e4c3f41 Linus Torvalds 2005-04-16 1032
^1da177e4c3f41 Linus Torvalds 2005-04-16 1033 bh_unlock_sock(sk);
7314f5480f3e37 Cong Wang 2018-12-29 1034 sock_put(sk);
5cc29e3bea7709 Ralf Baechle 2006-07-10 1035
5cc29e3bea7709 Ralf Baechle 2006-07-10 1036 nr_insert_socket(make);
5cc29e3bea7709 Ralf Baechle 2006-07-10 1037
5cc29e3bea7709 Ralf Baechle 2006-07-10 1038 nr_start_heartbeat(make);
5cc29e3bea7709 Ralf Baechle 2006-07-10 1039 nr_start_idletimer(make);
5cc29e3bea7709 Ralf Baechle 2006-07-10 1040
^1da177e4c3f41 Linus Torvalds 2005-04-16 1041 return 1;
^1da177e4c3f41 Linus Torvalds 2005-04-16 1042 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 1043
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists