Subject: Re: [PATCH net-next 4/5] ipv6: ioam: Generic Netlink to configure IOAM

From: Dan Carpenter <[email-masked]>
Date: Thu, 25 Jun 2020 13:52:37 +0300

Hi Justin,

url:    https://github.com/0day-ci/linux/commits/Justin-Iurman/Data-plane-support-for-IOAM-Pre-allocated-Trace-with-IPv6/20200625-033536
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 0558c396040734bc1d361919566a581fd41aa539
config: microblaze-randconfig-m031-20200624 (attached as .config)
compiler: microblaze-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email-masked]>
Reported-by: Dan Carpenter <[email-masked]>

New smatch warnings:
net/ipv6/ioam6.c:164 ioam6_genl_delns() error: we previously assumed 'ns->schema' could be null (see line 158)
net/ipv6/ioam6.c:358 ioam6_genl_delsc() error: we previously assumed 'sc->ns' could be null (see line 352)

# https://github.com/0day-ci/linux/commit/ce303f2d7c40f84739505f1daa7dac53daa6c4c5
git remote add linux-review https://github.com/0day-ci/linux
git remote update linux-review
git checkout ce303f2d7c40f84739505f1daa7dac53daa6c4c5
vim +164 net/ipv6/ioam6.c

ce303f2d7c40f8 Justin Iurman 2020-06-24  135  
ce303f2d7c40f8 Justin Iurman 2020-06-24  136  static int ioam6_genl_delns(struct sk_buff *skb, struct genl_info *info)
ce303f2d7c40f8 Justin Iurman 2020-06-24  137  {
ce303f2d7c40f8 Justin Iurman 2020-06-24  138  	struct net *net = genl_info_net(info);
ce303f2d7c40f8 Justin Iurman 2020-06-24  139  	struct ioam6_pernet_data *nsdata;
ce303f2d7c40f8 Justin Iurman 2020-06-24  140  	struct ioam6_namespace *ns;
ce303f2d7c40f8 Justin Iurman 2020-06-24  141  	__be16 ns_id;
ce303f2d7c40f8 Justin Iurman 2020-06-24  142  	int err;
ce303f2d7c40f8 Justin Iurman 2020-06-24  143  
ce303f2d7c40f8 Justin Iurman 2020-06-24  144  	if (!info->attrs[IOAM6_ATTR_NS_ID])
ce303f2d7c40f8 Justin Iurman 2020-06-24  145  		return -EINVAL;
ce303f2d7c40f8 Justin Iurman 2020-06-24  146  
ce303f2d7c40f8 Justin Iurman 2020-06-24  147  	ns_id = cpu_to_be16(nla_get_u16(info->attrs[IOAM6_ATTR_NS_ID]));
ce303f2d7c40f8 Justin Iurman 2020-06-24  148  	nsdata = ioam6_pernet(net);
ce303f2d7c40f8 Justin Iurman 2020-06-24  149  
ce303f2d7c40f8 Justin Iurman 2020-06-24  150  	mutex_lock(&nsdata->lock);
ce303f2d7c40f8 Justin Iurman 2020-06-24  151  
ce303f2d7c40f8 Justin Iurman 2020-06-24  152  	ns = rhashtable_lookup_fast(&nsdata->namespaces, &ns_id, rht_ns_params);
ce303f2d7c40f8 Justin Iurman 2020-06-24  153  	if (!ns) {
ce303f2d7c40f8 Justin Iurman 2020-06-24  154  		err = -ENOENT;
ce303f2d7c40f8 Justin Iurman 2020-06-24  155  		goto out_unlock;
ce303f2d7c40f8 Justin Iurman 2020-06-24  156  	}
ce303f2d7c40f8 Justin Iurman 2020-06-24  157  
ce303f2d7c40f8 Justin Iurman 2020-06-24 @158  	if (ns->schema)
                                                    ^^^^^^^^^^
Check for NULL

ce303f2d7c40f8 Justin Iurman 2020-06-24  159  		ns->schema->ns = NULL;
ce303f2d7c40f8 Justin Iurman 2020-06-24  160  
ce303f2d7c40f8 Justin Iurman 2020-06-24  161  	err = rhashtable_remove_fast(&nsdata->namespaces, &ns->head,
ce303f2d7c40f8 Justin Iurman 2020-06-24  162  				     rht_ns_params);
ce303f2d7c40f8 Justin Iurman 2020-06-24  163  	if (err) {
ce303f2d7c40f8 Justin Iurman 2020-06-24 @164  		ns->schema->ns = ns;
                                                        ^^^^^^^^^^^^^^
Unchecked dereference.

ce303f2d7c40f8 Justin Iurman 2020-06-24  165  		goto out_unlock;
ce303f2d7c40f8 Justin Iurman 2020-06-24  166  	}
ce303f2d7c40f8 Justin Iurman 2020-06-24  167  
ce303f2d7c40f8 Justin Iurman 2020-06-24  168  	ioam6_ns_release(ns);
ce303f2d7c40f8 Justin Iurman 2020-06-24  169  
ce303f2d7c40f8 Justin Iurman 2020-06-24  170  out_unlock:
ce303f2d7c40f8 Justin Iurman 2020-06-24  171  	mutex_unlock(&nsdata->lock);
ce303f2d7c40f8 Justin Iurman 2020-06-24  172  	return err;
ce303f2d7c40f8 Justin Iurman 2020-06-24  173  }

[ snip ]

ce303f2d7c40f8 Justin Iurman 2020-06-24  330  static int ioam6_genl_delsc(struct sk_buff *skb, struct genl_info *info)
ce303f2d7c40f8 Justin Iurman 2020-06-24  331  {
ce303f2d7c40f8 Justin Iurman 2020-06-24  332  	struct net *net = genl_info_net(info);
ce303f2d7c40f8 Justin Iurman 2020-06-24  333  	struct ioam6_pernet_data *nsdata;
ce303f2d7c40f8 Justin Iurman 2020-06-24  334  	struct ioam6_schema *sc;
ce303f2d7c40f8 Justin Iurman 2020-06-24  335  	u32 sc_id;
ce303f2d7c40f8 Justin Iurman 2020-06-24  336  	int err;
ce303f2d7c40f8 Justin Iurman 2020-06-24  337  
ce303f2d7c40f8 Justin Iurman 2020-06-24  338  	if (!info->attrs[IOAM6_ATTR_SC_ID])
ce303f2d7c40f8 Justin Iurman 2020-06-24  339  		return -EINVAL;
ce303f2d7c40f8 Justin Iurman 2020-06-24  340  
ce303f2d7c40f8 Justin Iurman 2020-06-24  341  	sc_id = nla_get_u32(info->attrs[IOAM6_ATTR_SC_ID]);
ce303f2d7c40f8 Justin Iurman 2020-06-24  342  	nsdata = ioam6_pernet(net);
ce303f2d7c40f8 Justin Iurman 2020-06-24  343  
ce303f2d7c40f8 Justin Iurman 2020-06-24  344  	mutex_lock(&nsdata->lock);
ce303f2d7c40f8 Justin Iurman 2020-06-24  345  
ce303f2d7c40f8 Justin Iurman 2020-06-24  346  	sc = rhashtable_lookup_fast(&nsdata->schemas, &sc_id, rht_sc_params);
ce303f2d7c40f8 Justin Iurman 2020-06-24  347  	if (!sc) {
ce303f2d7c40f8 Justin Iurman 2020-06-24  348  		err = -ENOENT;
ce303f2d7c40f8 Justin Iurman 2020-06-24  349  		goto out_unlock;
ce303f2d7c40f8 Justin Iurman 2020-06-24  350  	}
ce303f2d7c40f8 Justin Iurman 2020-06-24  351  
ce303f2d7c40f8 Justin Iurman 2020-06-24 @352  	if (sc->ns)
                                                    ^^^^^^
Check for NULL

ce303f2d7c40f8 Justin Iurman 2020-06-24  353  		sc->ns->schema = NULL;
ce303f2d7c40f8 Justin Iurman 2020-06-24  354  
ce303f2d7c40f8 Justin Iurman 2020-06-24  355  	err = rhashtable_remove_fast(&nsdata->schemas, &sc->head,
ce303f2d7c40f8 Justin Iurman 2020-06-24  356  				     rht_sc_params);
ce303f2d7c40f8 Justin Iurman 2020-06-24  357  	if (err) {
ce303f2d7c40f8 Justin Iurman 2020-06-24 @358  		sc->ns->schema = sc;
                                                        ^^^^^^^^^^^^^^
Unchecked dereference

ce303f2d7c40f8 Justin Iurman 2020-06-24  359  		goto out_unlock;
ce303f2d7c40f8 Justin Iurman 2020-06-24  360  	}
ce303f2d7c40f8 Justin Iurman 2020-06-24  361  
ce303f2d7c40f8 Justin Iurman 2020-06-24  362  	ioam6_sc_release(sc);
ce303f2d7c40f8 Justin Iurman 2020-06-24  363  
ce303f2d7c40f8 Justin Iurman 2020-06-24  364  out_unlock:
ce303f2d7c40f8 Justin Iurman 2020-06-24  365  	mutex_unlock(&nsdata->lock);
ce303f2d7c40f8 Justin Iurman 2020-06-24  366  	return err;
ce303f2d7c40f8 Justin Iurman 2020-06-24  367  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email-masked]