linux-kernel - Re: drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <6AAB7139-DE98-49BC-9DF9-F1819A39795E@suse.de>
Date:   Tue, 7 Nov 2023 14:34:38 +0800
From:   Coly Li <colyli@...e.de>
To:     Dan Carpenter <dan.carpenter@...aro.org>
Cc:     oe-kbuild@...ts.linux.dev, Zheng Wang <zyytlz.wz@....com>,
        lkp@...el.com, oe-kbuild-all@...ts.linux.dev,
        linux-kernel@...r.kernel.org, Jens Axboe <axboe@...nel.dk>
Subject: Re: drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n'
 dereferencing possible ERR_PTR()



> 2023年11月6日 17:11，Dan Carpenter <dan.carpenter@...aro.org> 写道：
> 
> Hi Zheng,
> 
> FYI, the error/warning was bisected to this commit, please ignore it if it's irrelevant.
> 
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head:   77fa2fbe87fc605c4bfa87dff87be9bfded0e9a3
> commit: 028ddcac477b691dd9205c92f991cc15259d033e bcache: Remove unnecessary NULL point check in node allocations
> config: x86_64-randconfig-161-20231102 (https://download.01.org/0day-ci/archive/20231106/202311060857.2jHVe0uk-lkp@intel.com/config)
> compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0
> reproduce: (https://download.01.org/0day-ci/archive/20231106/202311060857.2jHVe0uk-lkp@intel.com/reproduce)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@...el.com>
> | Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
> | Closes: https://lore.kernel.org/r/202311060857.2jHVe0uk-lkp@intel.com/
> 
> New smatch warnings:
> drivers/md/bcache/btree.c:1511 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()
> 
> Old smatch warnings:
> drivers/md/bcache/btree.c:1527 btree_gc_rewrite_node() error: 'n' dereferencing possible ERR_PTR()
> 
> vim +/n +1511 drivers/md/bcache/btree.c
> 
> 0a63b66db566cf Kent Overstreet 2014-03-17  1497  static int btree_gc_rewrite_node(struct btree *b, struct btree_op *op,
> 0a63b66db566cf Kent Overstreet 2014-03-17  1498   struct btree *replace)
> 0a63b66db566cf Kent Overstreet 2014-03-17  1499  {
> 0a63b66db566cf Kent Overstreet 2014-03-17  1500   struct keylist keys;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1501   struct btree *n;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1502  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1503   if (btree_check_reserve(b, NULL))
> 0a63b66db566cf Kent Overstreet 2014-03-17  1504   return 0;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1505  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1506   n = btree_node_alloc_replacement(replace, NULL);
> 
> Needs some error handling.  I don't know why the zero day bot is
> sending repeat warnings today but this one is still worth fixing.
> I guess the zero day bot sent the previous warning to the wrong people
> last time.

Yes this is a valid report. I feel checking n after btree_node_alloc_replacement() is necessary, and recent change from Zheng exported this potential issue to static code checking tool.

Since Zheng doesn’t respond yet, I will post a patch to fix the potential issue.

Thanks.


Coly Li


> 
> https://lore.kernel.org/all/bab6966d-3f96-44a0-b666-ddf976179eab@kadam.mountain/
> 
> 0a63b66db566cf Kent Overstreet 2014-03-17  1507  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1508   /* recheck reserve after allocating replacement node */
> 0a63b66db566cf Kent Overstreet 2014-03-17  1509   if (btree_check_reserve(b, NULL)) {
> 0a63b66db566cf Kent Overstreet 2014-03-17  1510   btree_node_free(n);
> 0a63b66db566cf Kent Overstreet 2014-03-17 @1511   rw_unlock(true, n);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1512   return 0;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1513   }
> 0a63b66db566cf Kent Overstreet 2014-03-17  1514  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1515   bch_btree_node_write_sync(n);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1516  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1517   bch_keylist_init(&keys);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1518   bch_keylist_add(&keys, &n->key);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1519  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1520   make_btree_freeing_key(replace, keys.top);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1521   bch_keylist_push(&keys);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1522  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1523   bch_btree_insert_node(b, op, &keys, NULL, NULL);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1524   BUG_ON(!bch_keylist_empty(&keys));
> 0a63b66db566cf Kent Overstreet 2014-03-17  1525  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1526   btree_node_free(replace);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1527   rw_unlock(true, n);
> 0a63b66db566cf Kent Overstreet 2014-03-17  1528  
> 0a63b66db566cf Kent Overstreet 2014-03-17  1529   /* Invalidated our iterator */
> 0a63b66db566cf Kent Overstreet 2014-03-17  1530   return -EINTR;
> 0a63b66db566cf Kent Overstreet 2014-03-17  1531  }
> 
> -- 
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki
>