netdev - Re: [PATCH net-next] net: check return value of rhashtable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 19 Sep 2021 10:50:13 +0300
From:   Roi Dayan <roid@...dia.com>
To:     MichelleJin <shjy180909@...il.com>, <davem@...emloft.net>,
        <kuba@...nel.org>, <yoshfuji@...ux-ipv6.org>, <dsahern@...nel.org>,
        <johannes@...solutions.net>
CC:     <saeedm@...dia.com>, <leon@...nel.org>, <paulb@...dia.com>,
        <lariel@...dia.com>, <ozsh@...dia.com>, <vladbu@...dia.com>,
        <cmi@...dia.com>, <netdev@...r.kernel.org>,
        <linux-rdma@...r.kernel.org>, <linux-wireless@...r.kernel.org>
Subject: Re: [PATCH net-next] net: check return value of rhashtable_init



On 2021-09-14 7:18 PM, MichelleJin wrote:
> Handling errors of rhashtable_init.
> 
> When rhashtable_init fails, it returns -EINVAL.
> 
> Signed-off-by: MichelleJin <shjy180909@...il.com>
> ---
>   .../net/ethernet/mellanox/mlx5/core/en/tc_ct.c    | 15 ++++++++++++---
>   net/ipv6/ila/ila_xlat.c                           |  4 +++-
>   net/ipv6/seg6_hmac.c                              |  6 +++++-
>   net/mac80211/mesh_pathtbl.c                       |  3 ++-
>   4 files changed, 22 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> index 6c949abcd2e1..5ae3b97df10e 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
> @@ -2127,12 +2127,21 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains,
>   
>   	ct_priv->post_act = post_act;
>   	mutex_init(&ct_priv->control_lock);
> -	rhashtable_init(&ct_priv->zone_ht, &zone_params);
> -	rhashtable_init(&ct_priv->ct_tuples_ht, &tuples_ht_params);
> -	rhashtable_init(&ct_priv->ct_tuples_nat_ht, &tuples_nat_ht_params);
> +	if (rhashtable_init(&ct_priv->zone_ht, &zone_params))
> +		goto err_ct_zone_ht;
> +	if (rhashtable_init(&ct_priv->ct_tuples_ht, &tuples_ht_params))
> +		goto err_ct_tuples_ht;
> +	if (rhashtable_init(&ct_priv->ct_tuples_nat_ht, &tuples_nat_ht_params))
> +		goto err_ct_tuples_nat_ht;
>   

you don't need to destroy the ht that failed to init.
so if zone_ht fails jump to err_ct_nat_tbl.
and if ct_tuple_ht fails jump to err_ct_zone_ht. etc.

>   	return ct_priv;
>   
> +err_ct_tuples_nat_ht:
> +	rhashtable_destroy(&ct_priv->ct_tuples_nat_ht);
> +err_ct_tuples_ht:
> +	rhashtable_destroy(&ct_priv->ct_tuples_ht);
> +err_ct_zone_ht:
> +	rhashtable_destroy(&ct_priv->zone_ht);
>   err_ct_nat_tbl:
>   	mlx5_chains_destroy_global_table(chains, ct_priv->ct);
>   err_ct_tbl:
> diff --git a/net/ipv6/ila/ila_xlat.c b/net/ipv6/ila/ila_xlat.c
> index a1ac0e3d8c60..481d475353ea 100644
> --- a/net/ipv6/ila/ila_xlat.c
> +++ b/net/ipv6/ila/ila_xlat.c
> @@ -610,7 +610,9 @@ int ila_xlat_init_net(struct net *net)
>   	if (err)
>   		return err;
>   
> -	rhashtable_init(&ilan->xlat.rhash_table, &rht_params);
> +	err = rhashtable_init(&ilan->xlat.rhash_table, &rht_params);
> +	if (err)
> +		return err;
>   

since you return an error i think you need to free the allocated
locks called a line up with alloc_ila_locks(ilan);
I think with free_bucket_spinlocks(ilan->xlat.locks); 



>   	return 0;
>   }
> diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
> index 687d95dce085..a78554993163 100644
> --- a/net/ipv6/seg6_hmac.c
> +++ b/net/ipv6/seg6_hmac.c
> @@ -403,9 +403,13 @@ EXPORT_SYMBOL(seg6_hmac_init);
>   
>   int __net_init seg6_hmac_net_init(struct net *net)
>   {
> +	int err;
> +
>   	struct seg6_pernet_data *sdata = seg6_pernet(net);
>   
> -	rhashtable_init(&sdata->hmac_infos, &rht_params);
> +	err = rhashtable_init(&sdata->hmac_infos, &rht_params);
> +	if (err)
> +		return err;

here you can just return rhashtable_init().
note I see the caller, seg6_net_init(), doesn't check for error.

>   
>   	return 0;
>   }
> diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
> index efbefcbac3ac..3ef5d6e00410 100644
> --- a/net/mac80211/mesh_pathtbl.c
> +++ b/net/mac80211/mesh_pathtbl.c
> @@ -60,7 +60,8 @@ static struct mesh_table *mesh_table_alloc(void)
>   	atomic_set(&newtbl->entries,  0);
>   	spin_lock_init(&newtbl->gates_lock);
>   	spin_lock_init(&newtbl->walk_lock);
> -	rhashtable_init(&newtbl->rhead, &mesh_rht_params);
> +	if (rhashtable_init(&newtbl->rhead, &mesh_rht_params))
> +		return NULL;

looks like there is a memleak here then. you need to release newtbl
before returning null.

>   
>   	return newtbl;
>   }
>