netdev - Re: [PATCH RFC net] igc: Avoid dereference of ptr_err in igc_clean_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <278e2ad2-847d-44a5-9bfe-46e11f4fea80@kadam.mountain>
Date: Thu, 15 Jun 2023 17:25:00 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Simon Horman <horms@...nel.org>
Cc: Jesse Brandeburg <jesse.brandeburg@...el.com>,
	Tony Nguyen <anthony.l.nguyen@...el.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Andre Guedes <andre.guedes@...el.com>,
	Daniel Borkmann <daniel@...earbox.net>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Florian Kauer <florian.kauer@...utronix.de>,
	Jakub Kicinski <kuba@...nel.org>,
	Jesper Dangaard Brouer <hawk@...nel.org>,
	Jithu Joseph <jithu.joseph@...el.com>,
	John Fastabend <john.fastabend@...il.com>,
	Maciej Fijalkowski <maciej.fijalkowski@...el.com>,
	Paolo Abeni <pabeni@...hat.com>,
	Vedang Patel <vedang.patel@...el.com>,
	intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
	bpf@...r.kernel.org
Subject: Re: [PATCH RFC net] igc: Avoid dereference of ptr_err in
 igc_clean_rx_irq()

The original code is okay.  Passing zero to ERR_PTR() is intentional.

On Thu, Jun 15, 2023 at 11:45:36AM +0200, Simon Horman wrote:
> In igc_clean_rx_irq() the result of a call to igc_xdp_run_prog() is assigned
> to the skb local variable. This may be an ERR_PTR.
> 
> A little later the following is executed, which seems to be a
> possible dereference of an ERR_PTR.
> 
> 	total_bytes += skb->len;


There is an IS_ERR() check in igc_cleanup_headers() which prevents
this.  Sort of tricky to see.  Do you have the cross function database
set up?  If so then Smatch shouldn't warn about this dereference.

> 
> Avoid this problem by continuing the loop in which all of the
> above occurs once the handling of the NULL case completes.
> 
> This proposed fix is speculative - I do not have deep knowledge of this
> driver.  And I am concerned about the effect of skipping the following
> logic:
> 
>   igc_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt);
>   cleaned_count++;
> 
> Flagged by Smatch as:
> 
>   .../igc_main.c:2467 igc_xdp_run_prog() warn: passing zero to 'ERR_PTR'

Linus once complained to me that this check is bogus and passing zero to
ERR_PTR() is fine and an intended use case.  But actually this test
does really find a lot of bugs.  I think for new warnings it is less
than 10% false positives.  But we fix the bugs so warnings which are
over three month old are probably 97% false positives.

regards,
dan carpenter