linux-kernel - Re: [PATCH] net: ipv4: Fix uninitialized pointer warning in fnhe_remove

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250417220022.23265-1-kuniyu@amazon.com>
Date: Thu, 17 Apr 2025 15:00:07 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <purvayeshi550@...il.com>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <edumazet@...gle.com>,
	<horms@...nel.org>, <kuba@...nel.org>, <linux-kernel@...r.kernel.org>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>
Subject: Re: [PATCH] net: ipv4: Fix uninitialized pointer warning in fnhe_remove_oldest

From: Purva Yeshi <purvayeshi550@...il.com>
Date: Thu, 17 Apr 2025 15:11:26 +0530
> Fix Smatch-detected issue:
> net/ipv4/route.c:605 fnhe_remove_oldest() error:
> uninitialized symbol 'oldest_p'.
> 
> Initialize oldest_p to NULL to avoid uninitialized pointer warning in
> fnhe_remove_oldest.

How does it remain uninitialised ?

update_or_create_fnhe() ensures the bucket is not empty before
calling fnhe_remove_oldest().


> 
> Check that oldest_p is not NULL after the loop to ensure no dereferencing
> of uninitialized pointers.
> 
> Signed-off-by: Purva Yeshi <purvayeshi550@...il.com>
> ---
>  net/ipv4/route.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index 753704f75b2c..2e5159127cb9 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -587,7 +587,7 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
>  
>  static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
>  {
> -	struct fib_nh_exception __rcu **fnhe_p, **oldest_p;
> +	struct fib_nh_exception __rcu **fnhe_p, **oldest_p = NULL;
>  	struct fib_nh_exception *fnhe, *oldest = NULL;
>  
>  	for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) {
> @@ -601,9 +601,12 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
>  			oldest_p = fnhe_p;
>  		}
>  	}
> -	fnhe_flush_routes(oldest);
> -	*oldest_p = oldest->fnhe_next;
> -	kfree_rcu(oldest, rcu);
> +
> +	if (oldest_p) {  /* Ensure to have valid oldest_p element */
> +		fnhe_flush_routes(oldest);
> +		*oldest_p = oldest->fnhe_next;
> +		kfree_rcu(oldest, rcu);
> +	}
>  }
>  
>  static u32 fnhe_hashfun(__be32 daddr)
> --