Messages in this thread | | | From | Petr Machata <> | Subject | Re: [PATCH net-next v2 3/6] net: dcb: add new rewrite table | Date | Thu, 19 Jan 2023 10:38:03 +0100 |
| |
Dan Carpenter <error27@gmail.com> writes:
> On Wed, Jan 18, 2023 at 11:54:23AM +0100, Petr Machata wrote: >> > + >> > + spin_lock_bh(&dcb_lock); >> > + list_for_each_entry(itr, &dcb_rewr_list, list) { >> > + if (itr->ifindex == netdev->ifindex) { >> > + enum ieee_attrs_app type = >> > + dcbnl_app_attr_type_get(itr->app.selector); >> > + err = nla_put(skb, type, sizeof(itr->app), &itr->app); >> > + if (err) { >> > + spin_unlock_bh(&dcb_lock); >> >> This should cancel the nest started above. >> > > If you see a bug like this, you may as well ask Julia or me to add a > static checker warning for it. We're both already on the CC list but we > might not be following the conversation closely...
I'll try to remember next time.
> In Smatch, I thought it would be easy but it turned out I need to add > a hack around to change the second nla_nest_start_noflag() from unknown > to valid pointer. > > diff --git a/check_unwind.c b/check_unwind.c > index a397afd2346b..3128476cbeb6 100644 > --- a/check_unwind.c > +++ b/check_unwind.c > @@ -94,6 +94,11 @@ static struct ref_func_info func_table[] = { > > { "ieee80211_alloc_hw", ALLOC, -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval }, > { "ieee80211_free_hw", RELEASE, 0, "$" }, > + > + { "nla_nest_start_noflag", ALLOC, 0, "$", &valid_ptr_min_sval, &valid_ptr_max_sval }, > + { "nla_nest_start", ALLOC, 0, "$", &valid_ptr_min_sval, &valid_ptr_max_sval }, > + { "nla_nest_end", RELEASE, 0, "$" }, > + { "nla_nest_cancel", RELEASE, 0, "$" }, > }; > > static struct smatch_state *unmatched_state(struct sm_state *sm) > diff --git a/smatch_data/db/kernel.return_fixes b/smatch_data/db/kernel.return_fixes > index fa4ed4ba5f0f..4782c5e10cdb 100644 > --- a/smatch_data/db/kernel.return_fixes > +++ b/smatch_data/db/kernel.return_fixes > @@ -90,3 +90,4 @@ dma_resv_wait_timeout s64min-(-1),1-s64max 1-s64max[<=$3] > mmc_io_rw_direct_host s32min-(-1),1-s32max (-4095)-(-1) > ad3552r_transfer s32min-(-1),1-s32max (-4095)-(-1) > adin1110_read_reg s32min-(-1),1-s32max (-4095)-(-1) > +nla_nest_start_noflag 0-u64max 4096-ptr_max > > Unfortunately, there is something weird going on and only my unreleased > version of Smatch finds the bug: > > net/dcb/dcbnl.c:1306 dcbnl_ieee_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1160,1171,1184,1197,1207,1217,1222,1232,1257. > net/dcb/dcbnl.c:1502 dcbnl_cee_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1502.
Looking at a couple of those, yeah, it looks legit. Those are missing the cancel on error returns.
> I have been working on that check recently... Both the released and > unreleased versions of Smatch have the following complaints: > > net/dcb/dcbnl.c:400 dcbnl_getnumtcs() warn: 'skb' from nla_nest_start_noflag() not released on lines: 396. > net/dcb/dcbnl.c:1061 dcbnl_build_peer_app() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1061. > net/dcb/dcbnl.c:1359 dcbnl_cee_pg_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1324,1342.
Likewise. Strange that each version reports a different subset. Or is that just selective quoting?
| |