linux-kernel - Re: [PATCH net-next v2 3/6] net: dcb: add new rewrite table

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y8gLRF7/0sttKkPx@kadam>
Date:   Wed, 18 Jan 2023 18:07:48 +0300
From:   Dan Carpenter <error27@...il.com>
To:     Petr Machata <petrm@...dia.com>
Cc:     Daniel Machon <daniel.machon@...rochip.com>,
        netdev@...r.kernel.org, davem@...emloft.net, edumazet@...gle.com,
        kuba@...nel.org, pabeni@...hat.com, lars.povlsen@...rochip.com,
        Steen.Hegelund@...rochip.com, UNGLinuxDriver@...rochip.com,
        joe@...ches.com, horatiu.vultur@...rochip.com,
        Julia.Lawall@...ia.fr, vladimir.oltean@....com,
        maxime.chevallier@...tlin.com,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next v2 3/6] net: dcb: add new rewrite table

On Wed, Jan 18, 2023 at 11:54:23AM +0100, Petr Machata wrote:
> > @@ -1241,6 +1242,26 @@ static int dcbnl_ieee_fill(struct sk_buff *skb, struct net_device *netdev)
> >  	spin_unlock_bh(&dcb_lock);
> >  	nla_nest_end(skb, app);
> >  
> > +	rewr = nla_nest_start_noflag(skb, DCB_ATTR_DCB_REWR_TABLE);
> > +	if (!rewr)
> > +		return -EMSGSIZE;
> 
> This being new code, don't use _noflag please.
> 
> > +
> > +	spin_lock_bh(&dcb_lock);
> > +	list_for_each_entry(itr, &dcb_rewr_list, list) {
> > +		if (itr->ifindex == netdev->ifindex) {
> > +			enum ieee_attrs_app type =
> > +				dcbnl_app_attr_type_get(itr->app.selector);
> > +			err = nla_put(skb, type, sizeof(itr->app), &itr->app);
> > +			if (err) {
> > +				spin_unlock_bh(&dcb_lock);
> 
> This should cancel the nest started above.
> 
> I wonder if it would be cleaner in a separate function, so that there
> can be a dedicated clean-up block to goto.
> 
> > +				return -EMSGSIZE;
> > +			}
> > +		}
> > +	}
> > +
> > +	spin_unlock_bh(&dcb_lock);
> > +	nla_nest_end(skb, rewr);

If you see a bug like this, you may as well ask Julia or me to add a
static checker warning for it.  We're both already on the CC list but we
might not be following the conversation closely...

In Smatch, I thought it would be easy but it turned out I need to add
a hack around to change the second nla_nest_start_noflag() from unknown
to valid pointer.

diff --git a/check_unwind.c b/check_unwind.c
index a397afd2346b..3128476cbeb6 100644
--- a/check_unwind.c
+++ b/check_unwind.c
@@ -94,6 +94,11 @@ static struct ref_func_info func_table[] = {
 
 	{ "ieee80211_alloc_hw", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
 	{ "ieee80211_free_hw",  RELEASE, 0, "$" },
+
+	{ "nla_nest_start_noflag", ALLOC, 0, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
+	{ "nla_nest_start", ALLOC, 0, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
+	{ "nla_nest_end", RELEASE, 0, "$" },
+	{ "nla_nest_cancel", RELEASE, 0, "$" },
 };
 
 static struct smatch_state *unmatched_state(struct sm_state *sm)
diff --git a/smatch_data/db/kernel.return_fixes b/smatch_data/db/kernel.return_fixes
index fa4ed4ba5f0f..4782c5e10cdb 100644
--- a/smatch_data/db/kernel.return_fixes
+++ b/smatch_data/db/kernel.return_fixes
@@ -90,3 +90,4 @@ dma_resv_wait_timeout s64min-(-1),1-s64max 1-s64max[<=$3]
 mmc_io_rw_direct_host s32min-(-1),1-s32max (-4095)-(-1)
 ad3552r_transfer s32min-(-1),1-s32max (-4095)-(-1)
 adin1110_read_reg s32min-(-1),1-s32max (-4095)-(-1)
+nla_nest_start_noflag 0-u64max 4096-ptr_max

Unfortunately, there is something weird going on and only my unreleased
version of Smatch finds the bug:

net/dcb/dcbnl.c:1306 dcbnl_ieee_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1160,1171,1184,1197,1207,1217,1222,1232,1257.
net/dcb/dcbnl.c:1502 dcbnl_cee_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1502.

I have been working on that check recently...  Both the released and
unreleased versions of Smatch have the following complaints:

net/dcb/dcbnl.c:400 dcbnl_getnumtcs() warn: 'skb' from nla_nest_start_noflag() not released on lines: 396.
net/dcb/dcbnl.c:1061 dcbnl_build_peer_app() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1061.
net/dcb/dcbnl.c:1359 dcbnl_cee_pg_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1324,1342.

regards,
dan carpenter