linux-kernel - Re: [PATCH] block: aoenet: Replace GFP_ATOMIC with GFP_KERNEL in aoenet

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <E3E5439F-2603-42E5-85F3-F2055EFBA3F1@cashinworks.com>
Date:   Sun, 28 Jan 2018 10:40:36 -0500
From:   Ed Cashin <ed@...hinworks.com>
To:     Jia-Ju Bai <baijiaju1990@...il.com>
Cc:     ed.cashin@....org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] block: aoenet: Replace GFP_ATOMIC with GFP_KERNEL in aoenet_rcv

Good luck in your efforts, and thanks for your work on static analysis.

> On Jan 27, 2018, at 9:12 PM, Jia-Ju Bai <baijiaju1990@...il.com> wrote:
> 
> 
> 
>> On 2018/1/28 1:48, Ed Cashin wrote:
>> If the tool cannot tell whether the protected state is manipulated by *another* piece of code called in atomic context, then it's insufficient.
>> 
>>> On Jan 26, 2018, at 4:37 AM, Jia-Ju Bai <baijiaju1990@...il.com> wrote:
>>> 
>>> After checking all possible call chains to aoenet_rcv(),
>>> my tool finds that aoenet_rcv() is never called in atomic context,
>>> namely never in an interrupt handler or holding a spinlock.
>>> Thus GFP_ATOMIC is not necessary, and it can be replaced with GFP_KERNEL.
>>> 
>>> This is found by a static analysis tool named DCNS written by myself.
>>> 
>>> Signed-off-by: Jia-Ju Bai <baijiaju1990@...il.com>
>>> ---
>>> drivers/block/aoe/aoenet.c |    2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>> 
>>> diff --git a/drivers/block/aoe/aoenet.c b/drivers/block/aoe/aoenet.c
>>> index 63773a9..d5fff7a 100644
>>> --- a/drivers/block/aoe/aoenet.c
>>> +++ b/drivers/block/aoe/aoenet.c
>>> @@ -138,7 +138,7 @@ static int __init aoe_iflist_setup(char *str)
>>>    if (dev_net(ifp) != &init_net)
>>>        goto exit;
>>> 
>>> -    skb = skb_share_check(skb, GFP_ATOMIC);
>>> +    skb = skb_share_check(skb, GFP_KERNEL);
>>>    if (skb == NULL)
>>>        return 0;
>>>    if (!is_aoe_netif(ifp))
>>> -- 
>>> 1.7.9.5
>>> 
>>> 
> 
> Sorry, I find my report is false positive after I manually check the code.
> aoenet_rcv() is used as function pointer via "->func", and it is called in dev_queue_xmit_nit() in net/core/dev.c.
> dev_queue_xmit_nit() calls a rcu_read_lock() before it calls pt_prev->func().
> Thus it is right to use GFP_ATOMIC in aoenet_rcv().
> Sorry again for my incorrect report...
> 
> Thanks,
> Jia-Ju Bai