netdev - Re: [net-next:master 2/15] net/unix/af_unix.c:2471 manage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d5011700-18f1-a223-c6da-bee7f1526caf@oracle.com>
Date:   Fri, 6 Aug 2021 10:22:00 -0700
From:   Shoaib Rao <rao.shoaib@...cle.com>
To:     Dan Carpenter <dan.carpenter@...cle.com>, kbuild@...ts.01.org
Cc:     lkp@...el.com, kbuild-all@...ts.01.org, netdev@...r.kernel.org
Subject: Re: [net-next:master 2/15] net/unix/af_unix.c:2471 manage_oob() warn:
 returning freed memory 'skb'

This is a false positive. consume_skb does necessarily frees the skb, it 
decrements the refcnt abd if no reference exists frees the skb. In this 
case skb will not be freed. I used consume_skb as that is what the code 
uses.

Shoaib.

On 8/5/21 4:57 AM, Dan Carpenter wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
> head:   c2eecaa193ff1e516a1b389637169ae86a6fa867
> commit: 314001f0bf927015e459c9d387d62a231fe93af3 [2/15] af_unix: Add OOB support
> config: nios2-randconfig-m031-20210804 (attached as .config)
> compiler: nios2-linux-gcc (GCC) 10.3.0
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@...el.com>
> Reported-by: Dan Carpenter <dan.carpenter@...cle.com>
>
> New smatch warnings:
> net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
>
> vim +/skb +2471 net/unix/af_unix.c
>
> 314001f0bf9270 Rao Shoaib 2021-08-01  2446  static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
> 314001f0bf9270 Rao Shoaib 2021-08-01  2447  				  int flags, int copied)
> 314001f0bf9270 Rao Shoaib 2021-08-01  2448  {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2449  	struct unix_sock *u = unix_sk(sk);
> 314001f0bf9270 Rao Shoaib 2021-08-01  2450
> 314001f0bf9270 Rao Shoaib 2021-08-01  2451  	if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2452  		skb_unlink(skb, &sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01  2453  		consume_skb(skb);
> 314001f0bf9270 Rao Shoaib 2021-08-01  2454  		skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01  2455  	} else {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2456  		if (skb == u->oob_skb) {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2457  			if (copied) {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2458  				skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01  2459  			} else if (sock_flag(sk, SOCK_URGINLINE)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2460  				if (!(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2461  					u->oob_skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01  2462  					consume_skb(skb);
>
> Need to set "skb = NULL;" after the consume.
>
> 314001f0bf9270 Rao Shoaib 2021-08-01  2463  				}
> 314001f0bf9270 Rao Shoaib 2021-08-01  2464  			} else if (!(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01  2465  				skb_unlink(skb, &sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01  2466  				consume_skb(skb);
> 314001f0bf9270 Rao Shoaib 2021-08-01  2467  				skb = skb_peek(&sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01  2468  			}
> 314001f0bf9270 Rao Shoaib 2021-08-01  2469  		}
> 314001f0bf9270 Rao Shoaib 2021-08-01  2470  	}
> 314001f0bf9270 Rao Shoaib 2021-08-01 @2471  	return skb;
> 314001f0bf9270 Rao Shoaib 2021-08-01  2472  }
>
> ---
> 0-DAY CI Kernel Test Service, Intel Corporation
> https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
>