netdev - Re: [net v1] devlink: fix xa_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <10e27c4b-84d8-4c63-9aea-d6d6197510d9@lunn.ch>
Date: Fri, 14 Feb 2025 15:14:17 +0100
From: Andrew Lunn <andrew@...n.ch>
To: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>
Cc: netdev@...r.kernel.org, jiri@...nulli.us, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
	horms@...nel.org, pierre@...ckhpc.com,
	Dan Carpenter <error27@...il.com>
Subject: Re: [net v1] devlink: fix xa_alloc_cyclic error handling

On Fri, Feb 14, 2025 at 02:58:41PM +0100, Michal Swiatkowski wrote:
> On Fri, Feb 14, 2025 at 02:44:49PM +0100, Andrew Lunn wrote:
> > On Fri, Feb 14, 2025 at 02:24:53PM +0100, Michal Swiatkowski wrote:
> > > Pierre Riteau <pierre@...ckhpc.com> found suspicious handling an error
> > > from xa_alloc_cyclic() in scheduler code [1]. The same is done in
> > > devlink_rel_alloc().
> > 
> > If the same bug exists twice it might exist more times. Did you find
> > this instance by searching the whole tree? Or just networking?
> > 
> > This is also something which would be good to have the static
> > analysers check for. I wounder if smatch can check this?
> > 
> > 	Andrew
> > 
> 
> You are right, I checked only net folder and there are two usage like
> that in drivers. I will send v2 with wider fixing, thanks.
> 
> It can be not so easy to check. What if someone want to treat wrapping
> as an error (don't know if it is valid)? If one of the caller is
> checking err < 0 it will be fine.

I put Dan in Cc:, lets see what he thinks.

There is at least one other functions i can think of which has similar
behaviour, < 0 on error, 0 or 1 are both different sorts of
success. If there are two, there are probably more. Having tooling to
find this sort of problem would be nice, even if it has a high false
positive rate and needs combining with manual inspection.

	Andrew