linux-kernel - Re: [PATCH 2/2] selftests/net: fix uninitialized variables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 06 May 2024 14:00:24 -0400
From: Willem de Bruijn <willemdebruijn.kernel@...il.com>
To: John Hubbard <jhubbard@...dia.com>, 
 Shuah Khan <shuah@...nel.org>, 
 richardbgobert@...il.com
Cc: "David S . Miller" <davem@...emloft.net>, 
 Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, 
 Paolo Abeni <pabeni@...hat.com>, 
 Steffen Klassert <steffen.klassert@...unet.com>, 
 Herbert Xu <herbert@...dor.apana.org.au>, 
 Andreas Färber <afaerber@...e.de>, 
 Manivannan Sadhasivam <manivannan.sadhasivam@...aro.org>, 
 Matthieu Baerts <matttbe@...nel.org>, 
 Mat Martineau <martineau@...nel.org>, 
 Geliang Tang <geliang@...nel.org>, 
 Pravin B Shelar <pshelar@....org>, 
 Willem de Bruijn <willemdebruijn.kernel@...il.com>, 
 Alexander Mikhalitsyn <alexander@...alicyn.com>, 
 zhujun2 <zhujun2@...s.chinamobile.com>, 
 Petr Machata <petrm@...dia.com>, 
 Ido Schimmel <idosch@...dia.com>, 
 Hangbin Liu <liuhangbin@...il.com>, 
 Nikolay Aleksandrov <razor@...ckwall.org>, 
 Benjamin Poirier <bpoirier@...dia.com>, 
 Sebastian Andrzej Siewior <bigeasy@...utronix.de>, 
 Dmitry Safonov <0x7f454c46@...il.com>, 
 netdev@...r.kernel.org, 
 linux-arm-kernel@...ts.infradead.org, 
 linux-actions@...ts.infradead.org, 
 mptcp@...ts.linux.dev, 
 dev@...nvswitch.org, 
 Valentin Obst <kernel@...entinobst.de>, 
 linux-kselftest@...r.kernel.org, 
 LKML <linux-kernel@...r.kernel.org>, 
 llvm@...ts.linux.dev, 
 John Hubbard <jhubbard@...dia.com>
Subject: Re: [PATCH 2/2] selftests/net: fix uninitialized variables

John Hubbard wrote:
> When building with clang, via:
> 
>     make LLVM=1 -C tools/testing/selftest
> 
> ...clang warns about three variables that are not initialized in all
> cases:
> 
> 1) The opt_ipproto_off variable is used uninitialized if "testname" is
> not "ip". This seems like an actual bug.
> 
> 2) The addr_len is used uninitialized, but only in the assert case,
>    which bails out, so this is harmless.
> 
> 3) The family variable in add_listener() is only used uninitialized in
>    the error case (neither IPv4 nor IPv6 is specified), so it's also
>    harmless.
> 
> Fix by initializing each variable.
> 
> Signed-off-by: John Hubbard <jhubbard@...dia.com>
> ---
>  tools/testing/selftests/net/gro.c                 | 3 ++-
>  tools/testing/selftests/net/ip_local_port_range.c | 2 +-
>  tools/testing/selftests/net/mptcp/pm_nl_ctl.c     | 2 +-
>  3 files changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/testing/selftests/net/gro.c b/tools/testing/selftests/net/gro.c
> index 353e1e867fbb..0eb61edaad83 100644
> --- a/tools/testing/selftests/net/gro.c
> +++ b/tools/testing/selftests/net/gro.c
> @@ -110,7 +110,8 @@ static void setup_sock_filter(int fd)
>  	const int dport_off = tcp_offset + offsetof(struct tcphdr, dest);
>  	const int ethproto_off = offsetof(struct ethhdr, h_proto);
>  	int optlen = 0;
> -	int ipproto_off, opt_ipproto_off;
> +	int ipproto_off;
> +	int opt_ipproto_off = 0;

This is only intended to be used in the case where the IP proto is not TCP:

                        BPF_STMT(BPF_LD  + BPF_B   + BPF_ABS, ipproto_off),
+                       BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_TCP, 2, 0),
+                       BPF_STMT(BPF_LD  + BPF_B   + BPF_ABS, opt_ipproto_off),
                        BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, IPPROTO_TCP, 0, 5),

In that case the test tries again at a different offset that accounts
for optional IPv6 extension headers.

This is indeed buggy, in that it might accidentally accept packets
that should be dropped.

Initializing to 0 compares against against the first byte of the
Ethernet header. Which is an external argument to the test. So
safest is to initialize opt_ipproto_off to ipproto_off and just
repeat the previous check. Perhaps:

@@ -118,6 +118,7 @@ static void setup_sock_filter(int fd)
        else
                next_off = offsetof(struct ipv6hdr, nexthdr);
        ipproto_off = ETH_HLEN + next_off;
+       opt_ipproto_off = ipproto_off;  /* overridden later if may have exthdrs */