netdev - [bug report] rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <Z_-QeaIsAPU0n1eR@stanley.mountain>
Date: Wed, 16 Apr 2025 14:11:53 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: David Howells <dhowells@...hat.com>
Cc: linux-afs@...ts.infradead.org, netdev@...r.kernel.org
Subject: [bug report] rxrpc: rxgk: Implement the yfs-rxgk security class
 (GSSAPI)

Hello David Howells,

Commit 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security
class (GSSAPI)") from Apr 11, 2025 (linux-next), leads to the
following Smatch static checker warning:

	net/rxrpc/rxgk.c:501 rxgk_verify_packet_integrity()
	error: uninitialized symbol 'ac'.

net/rxrpc/rxgk.c
    467 static int rxgk_verify_packet_integrity(struct rxrpc_call *call,
    468                                         struct rxgk_context *gk,
    469                                         struct sk_buff *skb)
    470 {
    471         struct rxrpc_skb_priv *sp = rxrpc_skb(skb);
    472         struct rxgk_header *hdr;
    473         struct krb5_buffer metadata;
    474         unsigned int offset = sp->offset, len = sp->len;
    475         size_t data_offset = 0, data_len = len;
    476         u32 ac;
    477         int ret = -ENOMEM;
    478 
    479         _enter("");
    480 
    481         crypto_krb5_where_is_the_data(gk->krb5, KRB5_CHECKSUM_MODE,
    482                                       &data_offset, &data_len);
    483 
    484         hdr = kzalloc(sizeof(*hdr), GFP_NOFS);
    485         if (!hdr)
    486                 return -ENOMEM;
    487 
    488         hdr->epoch        = htonl(call->conn->proto.epoch);
    489         hdr->cid        = htonl(call->cid);
    490         hdr->call_number = htonl(call->call_id);
    491         hdr->seq        = htonl(sp->hdr.seq);
    492         hdr->sec_index        = htonl(call->security_ix);
    493         hdr->data_len        = htonl(data_len);
    494 
    495         metadata.len = sizeof(*hdr);
    496         metadata.data = hdr;
    497         ret = rxgk_verify_mic_skb(gk->krb5, gk->rx_Kc, &metadata,
    498                                   skb, &offset, &len, &ac);
    499         kfree(hdr);
    500         if (ret == -EPROTO) {
--> 501                 rxrpc_abort_eproto(call, skb, ac,

This is a false positive in Smatch, but why is only -EPROTO handled and
not other error codes?  It could be intentional, but it's hard for me to
be sure because I don't know the code well.

    502                                    rxgk_abort_1_verify_mic_eproto);
    503         } else {
    504                 sp->offset = offset;
    505                 sp->len = len;
    506         }
    507 
    508         rxgk_put(gk);
    509         _leave(" = %d", ret);
    510         return ret;
    511 }

regards,
dan carpenter