tree:   https://github.com/multipath-tcp/mptcp_net-next.git export
head:   e28f6a7575a0006d0d49de297e23dd915c59ba39
commit: 962c918a1ca2553fac7db45c2a2f9b84fa30a6d9 [5/10] mptcp: refactor token 
container.
config: x86_64-randconfig-m001-20200605 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-13) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <[email protected]>
Reported-by: Dan Carpenter <[email protected]>

smatch warnings:
net/mptcp/subflow.c:512 subflow_syn_recv_sock() error: uninitialized symbol 
'subflow_req'.

# 
https://github.com/multipath-tcp/mptcp_net-next/commit/962c918a1ca2553fac7db45c2a2f9b84fa30a6d9
git remote add mptcp https://github.com/multipath-tcp/mptcp_net-next.git
git remote update mptcp
git checkout 962c918a1ca2553fac7db45c2a2f9b84fa30a6d9
vim +/subflow_req +512 net/mptcp/subflow.c

cec37a6e41aae7 Peter Krystad    2020-01-21  430  static struct sock 
*subflow_syn_recv_sock(const struct sock *sk,
cec37a6e41aae7 Peter Krystad    2020-01-21  431                                 
          struct sk_buff *skb,
cec37a6e41aae7 Peter Krystad    2020-01-21  432                                 
          struct request_sock *req,
cec37a6e41aae7 Peter Krystad    2020-01-21  433                                 
          struct dst_entry *dst,
cec37a6e41aae7 Peter Krystad    2020-01-21  434                                 
          struct request_sock *req_unhash,
cec37a6e41aae7 Peter Krystad    2020-01-21  435                                 
          bool *own_req)
cec37a6e41aae7 Peter Krystad    2020-01-21  436  {
cec37a6e41aae7 Peter Krystad    2020-01-21  437         struct 
mptcp_subflow_context *listener = mptcp_subflow_ctx(sk);
cc7972ea193233 Christoph Paasch 2020-01-21  438         struct 
mptcp_subflow_request_sock *subflow_req;
                                                                                
           ^^^^^^^^^^^

cfde141ea3faa3 Paolo Abeni      2020-04-30  439         struct 
mptcp_options_received mp_opt;
f296234c98a8fc Peter Krystad    2020-03-27  440         bool fallback_is_fatal 
= false;
58b09919626bf9 Paolo Abeni      2020-03-13  441         struct sock *new_msk = 
NULL;
4c8941de781cf7 Paolo Abeni      2020-04-20  442         bool fallback = false;
cec37a6e41aae7 Peter Krystad    2020-01-21  443         struct sock *child;
cec37a6e41aae7 Peter Krystad    2020-01-21  444  
cec37a6e41aae7 Peter Krystad    2020-01-21  445         pr_debug("listener=%p, 
req=%p, conn=%p", listener, req, listener->conn);
cec37a6e41aae7 Peter Krystad    2020-01-21  446  
cfde141ea3faa3 Paolo Abeni      2020-04-30  447         /* we need later a 
valid 'mp_capable' value even when options are not
cfde141ea3faa3 Paolo Abeni      2020-04-30  448          * parsed
cfde141ea3faa3 Paolo Abeni      2020-04-30  449          */
cfde141ea3faa3 Paolo Abeni      2020-04-30  450         mp_opt.mp_capable = 0;
ae2dd7164943e0 Florian Westphal 2020-01-29  451         if 
(tcp_rsk(req)->is_mptcp == 0)
ae2dd7164943e0 Florian Westphal 2020-01-29  452                 goto 
create_child;
                                                                
^^^^^^^^^^^^^^^^^

ae2dd7164943e0 Florian Westphal 2020-01-29  453  
d22f4988ffecbe Christoph Paasch 2020-01-21  454         /* if the sk is 
MP_CAPABLE, we try to fetch the client key */
cc7972ea193233 Christoph Paasch 2020-01-21  455         subflow_req = 
mptcp_subflow_rsk(req);
cc7972ea193233 Christoph Paasch 2020-01-21  456         if 
(subflow_req->mp_capable) {
d22f4988ffecbe Christoph Paasch 2020-01-21  457                 if 
(TCP_SKB_CB(skb)->seq != subflow_req->ssn_offset + 1) {
d22f4988ffecbe Christoph Paasch 2020-01-21  458                         /* here 
we can receive and accept an in-window,
d22f4988ffecbe Christoph Paasch 2020-01-21  459                          * 
out-of-order pkt, which will not carry the MP_CAPABLE
d22f4988ffecbe Christoph Paasch 2020-01-21  460                          * opt 
even on mptcp enabled paths
d22f4988ffecbe Christoph Paasch 2020-01-21  461                          */
58b09919626bf9 Paolo Abeni      2020-03-13  462                         goto 
create_msk;
d22f4988ffecbe Christoph Paasch 2020-01-21  463                 }
d22f4988ffecbe Christoph Paasch 2020-01-21  464  
cfde141ea3faa3 Paolo Abeni      2020-04-30  465                 
mptcp_get_options(skb, &mp_opt);
cfde141ea3faa3 Paolo Abeni      2020-04-30  466                 if 
(!mp_opt.mp_capable) {
4c8941de781cf7 Paolo Abeni      2020-04-20  467                         
fallback = true;
58b09919626bf9 Paolo Abeni      2020-03-13  468                         goto 
create_child;
d22f4988ffecbe Christoph Paasch 2020-01-21  469                 }
58b09919626bf9 Paolo Abeni      2020-03-13  470  
58b09919626bf9 Paolo Abeni      2020-03-13  471  create_msk:
cfde141ea3faa3 Paolo Abeni      2020-04-30  472                 new_msk = 
mptcp_sk_clone(listener->conn, &mp_opt, req);
58b09919626bf9 Paolo Abeni      2020-03-13  473                 if (!new_msk)
4c8941de781cf7 Paolo Abeni      2020-04-20  474                         
fallback = true;
f296234c98a8fc Peter Krystad    2020-03-27  475         } else if 
(subflow_req->mp_join) {
f296234c98a8fc Peter Krystad    2020-03-27  476                 
fallback_is_fatal = true;
cfde141ea3faa3 Paolo Abeni      2020-04-30  477                 
mptcp_get_options(skb, &mp_opt);
cfde141ea3faa3 Paolo Abeni      2020-04-30  478                 if 
(!mp_opt.mp_join ||
cfde141ea3faa3 Paolo Abeni      2020-04-30  479                     
!subflow_hmac_valid(req, &mp_opt)) {
fc518953bc9c8d Florian Westphal 2020-03-27  480                         
SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC);
f296234c98a8fc Peter Krystad    2020-03-27  481                         return 
NULL;
cc7972ea193233 Christoph Paasch 2020-01-21  482                 }
fc518953bc9c8d Florian Westphal 2020-03-27  483         }
cec37a6e41aae7 Peter Krystad    2020-01-21  484  
d22f4988ffecbe Christoph Paasch 2020-01-21  485  create_child:
                                                 ^^^^^^^^^^^^

cec37a6e41aae7 Peter Krystad    2020-01-21  486         child = 
listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
cec37a6e41aae7 Peter Krystad    2020-01-21  487                                 
                     req_unhash, own_req);
cec37a6e41aae7 Peter Krystad    2020-01-21  488  
cec37a6e41aae7 Peter Krystad    2020-01-21  489         if (child && *own_req) {
79c0949e9a09f6 Peter Krystad    2020-01-21  490                 struct 
mptcp_subflow_context *ctx = mptcp_subflow_ctx(child);
79c0949e9a09f6 Peter Krystad    2020-01-21  491  
90bf45134d55d6 Paolo Abeni      2020-05-15  492                 
tcp_rsk(req)->drop_req = false;
90bf45134d55d6 Paolo Abeni      2020-05-15  493  
4c8941de781cf7 Paolo Abeni      2020-04-20  494                 /* we need to 
fallback on ctx allocation failure and on pre-reqs
4c8941de781cf7 Paolo Abeni      2020-04-20  495                  * checking 
above. In the latter scenario we additionally need
4c8941de781cf7 Paolo Abeni      2020-04-20  496                  * to reset the 
context to non MPTCP status.
79c0949e9a09f6 Peter Krystad    2020-01-21  497                  */
4c8941de781cf7 Paolo Abeni      2020-04-20  498                 if (!ctx || 
fallback) {
f296234c98a8fc Peter Krystad    2020-03-27  499                         if 
(fallback_is_fatal)
729cd6436f359b Paolo Abeni      2020-05-15  500                                 
goto dispose_child;
4c8941de781cf7 Paolo Abeni      2020-04-20  501  
39884604b11692 Paolo Abeni      2020-05-29  502                         
subflow_drop_ctx(child);
58b09919626bf9 Paolo Abeni      2020-03-13  503                         goto 
out;
f296234c98a8fc Peter Krystad    2020-03-27  504                 }
79c0949e9a09f6 Peter Krystad    2020-01-21  505  
79c0949e9a09f6 Peter Krystad    2020-01-21  506                 if 
(ctx->mp_capable) {
58b09919626bf9 Paolo Abeni      2020-03-13  507                         /* new 
mpc subflow takes ownership of the newly
58b09919626bf9 Paolo Abeni      2020-03-13  508                          * 
created mptcp socket
58b09919626bf9 Paolo Abeni      2020-03-13  509                          */
df1036da90108b Florian Westphal 2020-04-17  510                         
new_msk->sk_destruct = mptcp_sock_destruct;
1b1c7a0ef7f323 Peter Krystad    2020-03-27  511                         
mptcp_pm_new_connection(mptcp_sk(new_msk), 1);
962c918a1ca255 Paolo Abeni      2020-06-05 @512                         
mptcp_token_accept(subflow_req, mptcp_sk(new_msk));
                                                                                
           ^^^^^^^^^^^
Potential uninitialized?

58b09919626bf9 Paolo Abeni      2020-03-13  513                         
ctx->conn = new_msk;
58b09919626bf9 Paolo Abeni      2020-03-13  514                         new_msk 
= NULL;
fca5c82c086ea3 Paolo Abeni      2020-04-20  515  
fca5c82c086ea3 Paolo Abeni      2020-04-20  516                         /* with 
OoO packets we can reach here without ingress
fca5c82c086ea3 Paolo Abeni      2020-04-20  517                          * mpc 
option
fca5c82c086ea3 Paolo Abeni      2020-04-20  518                          */
cfde141ea3faa3 Paolo Abeni      2020-04-30  519                         
ctx->remote_key = mp_opt.sndr_key;
cfde141ea3faa3 Paolo Abeni      2020-04-30  520                         
ctx->fully_established = mp_opt.mp_capable;
cfde141ea3faa3 Paolo Abeni      2020-04-30  521                         
ctx->can_ack = mp_opt.mp_capable;
f296234c98a8fc Peter Krystad    2020-03-27  522                 } else if 
(ctx->mp_join) {
f296234c98a8fc Peter Krystad    2020-03-27  523                         struct 
mptcp_sock *owner;
f296234c98a8fc Peter Krystad    2020-03-27  524  
f296234c98a8fc Peter Krystad    2020-03-27  525                         owner = 
mptcp_token_get_sock(ctx->token);
f296234c98a8fc Peter Krystad    2020-03-27  526                         if 
(!owner)
729cd6436f359b Paolo Abeni      2020-05-15  527                                 
goto dispose_child;
f296234c98a8fc Peter Krystad    2020-03-27  528  
f296234c98a8fc Peter Krystad    2020-03-27  529                         
ctx->conn = (struct sock *)owner;
f296234c98a8fc Peter Krystad    2020-03-27  530                         if 
(!mptcp_finish_join(child))
729cd6436f359b Paolo Abeni      2020-05-15  531                                 
goto dispose_child;
fc518953bc9c8d Florian Westphal 2020-03-27  532  
fc518953bc9c8d Florian Westphal 2020-03-27  533                         
SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKRX);
90bf45134d55d6 Paolo Abeni      2020-05-15  534                         
tcp_rsk(req)->drop_req = true;
cec37a6e41aae7 Peter Krystad    2020-01-21  535                 }
cec37a6e41aae7 Peter Krystad    2020-01-21  536         }
cec37a6e41aae7 Peter Krystad    2020-01-21  537  
58b09919626bf9 Paolo Abeni      2020-03-13  538  out:
58b09919626bf9 Paolo Abeni      2020-03-13  539         /* dispose of the left 
over mptcp master, if any */
58b09919626bf9 Paolo Abeni      2020-03-13  540         if (unlikely(new_msk))
9f5ca6a59816b4 Florian Westphal 2020-04-17  541                 
mptcp_force_close(new_msk);
4c8941de781cf7 Paolo Abeni      2020-04-20  542  
4c8941de781cf7 Paolo Abeni      2020-04-20  543         /* check for expected 
invariant - should never trigger, just help
4c8941de781cf7 Paolo Abeni      2020-04-20  544          * catching eariler 
subtle bugs
4c8941de781cf7 Paolo Abeni      2020-04-20  545          */
ac2b47fb92c506 Paolo Abeni      2020-04-30  546         WARN_ON_ONCE(child && 
*own_req && tcp_sk(child)->is_mptcp &&
4c8941de781cf7 Paolo Abeni      2020-04-20  547                      
(!mptcp_subflow_ctx(child) ||
4c8941de781cf7 Paolo Abeni      2020-04-20  548                       
!mptcp_subflow_ctx(child)->conn));
cec37a6e41aae7 Peter Krystad    2020-01-21  549         return child;
f296234c98a8fc Peter Krystad    2020-03-27  550  
729cd6436f359b Paolo Abeni      2020-05-15  551  dispose_child:
39884604b11692 Paolo Abeni      2020-05-29  552         subflow_drop_ctx(child);
729cd6436f359b Paolo Abeni      2020-05-15  553         tcp_rsk(req)->drop_req 
= true;
f296234c98a8fc Peter Krystad    2020-03-27  554         
tcp_send_active_reset(child, GFP_ATOMIC);
729cd6436f359b Paolo Abeni      2020-05-15  555         
inet_csk_prepare_for_destroy_sock(child);
f296234c98a8fc Peter Krystad    2020-03-27  556         tcp_done(child);
729cd6436f359b Paolo Abeni      2020-05-15  557  
729cd6436f359b Paolo Abeni      2020-05-15  558         /* The last child 
reference will be released by the caller */
729cd6436f359b Paolo Abeni      2020-05-15  559         return child;
cec37a6e41aae7 Peter Krystad    2020-01-21  560  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]

Attachment: .config.gz
Description: application/gzip

_______________________________________________
kbuild mailing list -- [email protected]
To unsubscribe send an email to [email protected]
_______________________________________________
kbuild mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to