netdev - Re: [net v1] devlink: fix xa_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <263574a4-4411-487b-bbb2-f3ff11daa19f@lunn.ch>
Date: Sun, 16 Feb 2025 17:08:23 +0100
From: Andrew Lunn <andrew@...n.ch>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Michal Swiatkowski <michal.swiatkowski@...ux.intel.com>,
	netdev@...r.kernel.org, jiri@...nulli.us, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
	horms@...nel.org, pierre@...ckhpc.com,
	Dan Carpenter <error27@...il.com>
Subject: Re: [net v1] devlink: fix xa_alloc_cyclic error handling

On Sun, Feb 16, 2025 at 06:06:48PM +0300, Dan Carpenter wrote:
> On Fri, Feb 14, 2025 at 02:44:49PM +0100, Andrew Lunn wrote:
> > On Fri, Feb 14, 2025 at 02:24:53PM +0100, Michal Swiatkowski wrote:
> > > Pierre Riteau <pierre@...ckhpc.com> found suspicious handling an error
> > > from xa_alloc_cyclic() in scheduler code [1]. The same is done in
> > > devlink_rel_alloc().
> > 
> > If the same bug exists twice it might exist more times. Did you find
> > this instance by searching the whole tree? Or just networking?
> > 
> > This is also something which would be good to have the static
> > analysers check for. I wounder if smatch can check this?
> 
> That's a great idea, thanks!  I'll try a couple experiments and see what
> works tomorrow.  I've add these lines to check_zero_to_err_ptr.c
> 
>    183          max = rl_max(estate_rl(sm->state));
>    184          if (max.value > 0 && !sval_is_a_max(max))
>    185                  sm_warning("passing non-max range '%s' to '%s'", sm->state->name, fn);
>    186  
> 
> I'm hoping this one works.  It complains about any positive returns
> except for when the return is "some non-zero value".
> 
>    194                  if (estate_get_single_value(tmp->state, &sval) &&
>    195                      (sval.value < -4096 || sval.value > 0)) {
>    196                          sm_warning("passing invalid error code %lld to '%s'", sval.value, fn);
>    197                          return;
>    198                  }
> 
> This one might miss some bugs but it should catch most stuff and have few
> false positives.  Both of them work on this example.
> 
> net/devlink/core.c:122 devlink_rel_alloc() warn: passing non-max range '(-4095)-(-1),1' to 'ERR_PTR'
> net/devlink/core.c:122 devlink_rel_alloc() warn: passing invalid error code 1 to 'ERR_PTR'

Nice. In networking, ethernet PHYs, there are a few functions ending
in _changed() have the same behaviour:

 * Returns negative errno, 0 if there was no change, and 1 in case of change

So there is the potential for the same issue with
mdiobus_modify_changed(), phy_modify_changed(),
phy_modify_mmd_changed(), phy_modify_paged_changed(). Hope this helps
with testing.

	Andrew