netdev - Re: [PATCH v5 net-next 10/12] flow_offload: add reoffload process to update hw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 7 Dec 2021 15:02:59 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     kbuild@...ts.01.org, Simon Horman <simon.horman@...igine.com>,
        netdev@...r.kernel.org
Cc:     lkp@...el.com, kbuild-all@...ts.01.org,
        Cong Wang <xiyou.wangcong@...il.com>,
        Ido Schimmel <idosch@...dia.com>,
        Jamal Hadi Salim <jhs@...atatu.com>,
        Jiri Pirko <jiri@...nulli.us>, Oz Shlomo <ozsh@...dia.com>,
        Roi Dayan <roid@...dia.com>, Vlad Buslov <vladbu@...dia.com>,
        Baowen Zheng <baowen.zheng@...igine.com>,
        Louis Peens <louis.peens@...igine.com>
Subject: Re: [PATCH v5 net-next 10/12] flow_offload: add reoffload process to
 update hw_count

Hi Simon,

url:    https://github.com/0day-ci/linux/commits/Simon-Horman/allow-user-to-offload-tc-action-to-net-device/20211203-202602
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 43332cf97425a3e5508c827c82201ecc5ddd54e0
config: i386-randconfig-m021-20211203 (https://download.01.org/0day-ci/archive/20211207/202112070927.kCpOi5qD-lkp@intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <dan.carpenter@...cle.com>

New smatch warnings:
net/sched/act_api.c:946 tcf_register_action() error: we previously assumed 'ops->id' could be null (see line 926)

vim +946 net/sched/act_api.c

ddf97ccdd7cb7e WANG Cong        2016-02-22  909  int tcf_register_action(struct tc_action_ops *act,
ddf97ccdd7cb7e WANG Cong        2016-02-22  910  			struct pernet_operations *ops)
^1da177e4c3f41 Linus Torvalds   2005-04-16  911  {
1f747c26c48bb2 WANG Cong        2013-12-15  912  	struct tc_action_ops *a;
ddf97ccdd7cb7e WANG Cong        2016-02-22  913  	int ret;
^1da177e4c3f41 Linus Torvalds   2005-04-16  914  
ddf97ccdd7cb7e WANG Cong        2016-02-22  915  	if (!act->act || !act->dump || !act->init || !act->walk || !act->lookup)
76c82d7a3d24a4 Jamal Hadi Salim 2013-12-04  916  		return -EINVAL;
76c82d7a3d24a4 Jamal Hadi Salim 2013-12-04  917  
ab102b80cef28c WANG Cong        2016-10-11  918  	/* We have to register pernet ops before making the action ops visible,
ab102b80cef28c WANG Cong        2016-10-11  919  	 * otherwise tcf_action_init_1() could get a partially initialized
ab102b80cef28c WANG Cong        2016-10-11  920  	 * netns.
ab102b80cef28c WANG Cong        2016-10-11  921  	 */
ab102b80cef28c WANG Cong        2016-10-11  922  	ret = register_pernet_subsys(ops);
ab102b80cef28c WANG Cong        2016-10-11  923  	if (ret)
ab102b80cef28c WANG Cong        2016-10-11  924  		return ret;
ab102b80cef28c WANG Cong        2016-10-11  925  
d99abedd4989e7 Baowen Zheng     2021-12-03 @926  	if (ops->id) {
                                                            ^^^^^^^
This code assumes "ops->id" can be NULL.

d99abedd4989e7 Baowen Zheng     2021-12-03  927  		ret = tcf_pernet_add_id_list(*ops->id);
d99abedd4989e7 Baowen Zheng     2021-12-03  928  		if (ret)
d99abedd4989e7 Baowen Zheng     2021-12-03  929  			goto err_id;
d99abedd4989e7 Baowen Zheng     2021-12-03  930  	}
d99abedd4989e7 Baowen Zheng     2021-12-03  931  
^1da177e4c3f41 Linus Torvalds   2005-04-16  932  	write_lock(&act_mod_lock);
1f747c26c48bb2 WANG Cong        2013-12-15  933  	list_for_each_entry(a, &act_base, head) {
eddd2cf195d6fb Eli Cohen        2019-02-10  934  		if (act->id == a->id || (strcmp(act->kind, a->kind) == 0)) {
d99abedd4989e7 Baowen Zheng     2021-12-03  935  			ret = -EEXIST;
d99abedd4989e7 Baowen Zheng     2021-12-03  936  			goto err_out;
^1da177e4c3f41 Linus Torvalds   2005-04-16  937  		}
^1da177e4c3f41 Linus Torvalds   2005-04-16  938  	}
1f747c26c48bb2 WANG Cong        2013-12-15  939  	list_add_tail(&act->head, &act_base);
^1da177e4c3f41 Linus Torvalds   2005-04-16  940  	write_unlock(&act_mod_lock);
ddf97ccdd7cb7e WANG Cong        2016-02-22  941  
^1da177e4c3f41 Linus Torvalds   2005-04-16  942  	return 0;
d99abedd4989e7 Baowen Zheng     2021-12-03  943  
d99abedd4989e7 Baowen Zheng     2021-12-03  944  err_out:
d99abedd4989e7 Baowen Zheng     2021-12-03  945  	write_unlock(&act_mod_lock);
d99abedd4989e7 Baowen Zheng     2021-12-03 @946  	tcf_pernet_del_id_list(*ops->id);
                                                                               ^^^^^^^^
This line dereferences it without checking.

d99abedd4989e7 Baowen Zheng     2021-12-03  947  err_id:
d99abedd4989e7 Baowen Zheng     2021-12-03  948  	unregister_pernet_subsys(ops);
d99abedd4989e7 Baowen Zheng     2021-12-03  949  	return ret;
^1da177e4c3f41 Linus Torvalds   2005-04-16  950  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org