netdev - Re: [PATCH v1 net 2/2] atm: clip: Fix potential null-ptr-deref in to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202507041113.tpHgxTvk-lkp@intel.com>
Date: Fri, 4 Jul 2025 11:23:50 +0800
From: kernel test robot <lkp@...el.com>
To: Kuniyuki Iwashima <kuniyu@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>
Cc: oe-kbuild-all@...ts.linux.dev, netdev@...r.kernel.org,
	Simon Horman <horms@...nel.org>,
	Kuniyuki Iwashima <kuniyu@...gle.com>
Subject: Re: [PATCH v1 net 2/2] atm: clip: Fix potential null-ptr-deref in
 to_atmarpd().

Hi Kuniyuki,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net/main]

url:    https://github.com/intel-lab-lkp/linux/commits/Kuniyuki-Iwashima/atm-clip-Fix-infinite-recursive-call-of-clip_push/20250702-100652
base:   net/main
patch link:    https://lore.kernel.org/r/20250702020437.703698-3-kuniyu%40google.com
patch subject: [PATCH v1 net 2/2] atm: clip: Fix potential null-ptr-deref in to_atmarpd().
config: i386-randconfig-063-20250704 (https://download.01.org/0day-ci/archive/20250704/202507041113.tpHgxTvk-lkp@intel.com/config)
compiler: clang version 20.1.7 (https://github.com/llvm/llvm-project 6146a88f60492b520a36f8f8f3231e15f3cc6082)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250704/202507041113.tpHgxTvk-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202507041113.tpHgxTvk-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
>> net/atm/clip.c:64:15: sparse: sparse: incompatible types in comparison expression (different address spaces):
   net/atm/clip.c:64:15: sparse:    struct atm_vcc [noderef] __rcu *
   net/atm/clip.c:64:15: sparse:    struct atm_vcc *
   net/atm/clip.c:625:9: sparse: sparse: incompatible types in comparison expression (different address spaces):
   net/atm/clip.c:625:9: sparse:    struct atm_vcc [noderef] __rcu *
   net/atm/clip.c:625:9: sparse:    struct atm_vcc *
   net/atm/clip.c:658:9: sparse: sparse: incompatible types in comparison expression (different address spaces):
   net/atm/clip.c:658:9: sparse:    struct atm_vcc [noderef] __rcu *
   net/atm/clip.c:658:9: sparse:    struct atm_vcc *

vim +64 net/atm/clip.c

    52	
    53	static int to_atmarpd(enum atmarp_ctrl_type type, int itf, __be32 ip)
    54	{
    55		struct sock *sk;
    56		struct atmarp_ctrl *ctrl;
    57		struct atm_vcc *vcc;
    58		struct sk_buff *skb;
    59		int err = 0;
    60	
    61		pr_debug("(%d)\n", type);
    62	
    63		rcu_read_lock();
  > 64		vcc = rcu_dereference(atmarpd);
    65		if (!vcc) {
    66			err = -EUNATCH;
    67			goto unlock;
    68		}
    69		skb = alloc_skb(sizeof(struct atmarp_ctrl), GFP_ATOMIC);
    70		if (!skb) {
    71			err = -ENOMEM;
    72			goto unlock;
    73		}
    74		ctrl = skb_put(skb, sizeof(struct atmarp_ctrl));
    75		ctrl->type = type;
    76		ctrl->itf_num = itf;
    77		ctrl->ip = ip;
    78		atm_force_charge(vcc, skb->truesize);
    79	
    80		sk = sk_atm(vcc);
    81		skb_queue_tail(&sk->sk_receive_queue, skb);
    82		sk->sk_data_ready(sk);
    83	unlock:
    84		rcu_read_unlock();
    85		return err;
    86	}
    87	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki