:::::: :::::: Manual check reason: "low confidence bisect report" :::::: Manual check reason: "low confidence static check warning: net/core/gro.c:417:77: warning: dereference of NULL 'macsec_p_ext' [CWE-476] [-Wanalyzer-null-dereference]" ::::::
CC: [email protected] BCC: [email protected] In-Reply-To: <[email protected]> References: <[email protected]> TO: Lior Nahmanson <[email protected]> TO: [email protected] TO: [email protected] TO: [email protected] CC: [email protected] CC: [email protected] CC: Lior Nahmanson <[email protected]> CC: Raed Salem <[email protected]> CC: Jiri Pirko <[email protected]> CC: "Ben Ben-Ishay" <[email protected]> Hi Lior, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on net-next/master] url: https://github.com/intel-lab-lkp/linux/commits/Lior-Nahmanson/Introduce-MACsec-offload-SKB-extension/20220613-211703 base: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 5f30671d8dc6b7a489435ce8c40a2036e3c16d04 :::::: branch date: 2 days ago :::::: commit date: 2 days ago config: x86_64-randconfig-c001-20220613 (https://download.01.org/0day-ci/archive/20220615/[email protected]/config) compiler: gcc-11 (Debian 11.3.0-3) 11.3.0 reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/9ee59a567b790747e39e7cdd959991b4d994fc52 git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Lior-Nahmanson/Introduce-MACsec-offload-SKB-extension/20220613-211703 git checkout 9ee59a567b790747e39e7cdd959991b4d994fc52 # save the config file ARCH=x86_64 KBUILD_USERCFLAGS='-fanalyzer -Wno-error' If you fix the issue, kindly add following tag where applicable Reported-by: kernel test robot <[email protected]> gcc-analyzer warnings: (new ones prefixed by >>) | 487 | static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb) | | ^~~~~~~~~~~~~~~ | | | | | (12) entry to 'dev_gro_receive' | 'dev_gro_receive': event 13 | |include/linux/netdevice.h:2340:12: | 2340 | if (!(dev->features & NETIF_F_GRO) || dev->xdp_prog) | | ^ | | | | | (13) following 'false' branch... | 'dev_gro_receive': event 14 | |net/core/gro.c:502:26: | 502 | gro_list_prepare(&gro_list->list, skb); | | ^~~~~~~~~~~~~~~ | | | | | (14) ...to here | 'dev_gro_receive': event 15 | |include/linux/rculist.h:392:30: | 392 | &pos->member != (head); \ | | ~~~~~~~~~~~~~^~~~~~~~~ | | | | | (15) following 'true' branch... net/core/gro.c:505:9: note: in expansion of macro 'list_for_each_entry_rcu' | 505 | list_for_each_entry_rcu(ptype, head, list) { | | ^~~~~~~~~~~~~~~~~~~~~~~ | 'dev_gro_receive': events 16-19 | | 506 | if (ptype->type != type || !ptype->callbacks.gro_receive) | | ~~~~~^~~~~~ | | | | | (16) ...to here |...... | 536 | if (&ptype->list == head) | | ~ | | | | | (17) following 'false' branch... |...... | 539 | if (PTR_ERR(pp) == -EINPROGRESS) { | | ~ | | | | | (18) ...to here | | (19) following 'false' branch (when 'pp != 18446744073709551501')... | 'dev_gro_receive': events 20-23 | | 544 | same_flow = NAPI_GRO_CB(skb)->same_flow; |...... | 547 | if (pp) { | | ~ | | | | | (21) following 'false' branch (when 'pp' is NULL)... |...... | 553 | if (same_flow) | | ~ | | | | | (22) ...to here | | (23) following 'false' branch... | 'dev_gro_receive': events 24-25 | | 556 | if (NAPI_GRO_CB(skb)->flush) | | ~ | | | | | (25) following 'false' branch... | 'dev_gro_receive': event 26 | | 559 | if (unlikely(gro_list->count >= MAX_GRO_SKBS)) | | ~~~~~~~~^~~~~~~ | | | | | (26) ...to here include/linux/compiler.h:78:45: note: in definition of macro 'unlikely' | 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | | ^ | 'dev_gro_receive': event 27 | |net/core/gro.c:566:32: | 566 | NAPI_GRO_CB(skb)->last = skb; | 'dev_gro_receive': event 28 | | 566 | NAPI_GRO_CB(skb)->last = skb; | 'dev_gro_receive': event 29 | |include/net/gro.h:128:19: | 128 | return skb->len - NAPI_GRO_CB(skb)->data_offset; | | ~~~^~~~~ | | | | | (29) dereference of NULL 'skb' | include/linux/skbuff.h: In function 'gro_list_prepare': >> net/core/gro.c:417:77: warning: dereference of NULL 'macsec_p_ext' [CWE-476] >> [-Wanalyzer-null-dereference] 417 | diffs |= (__force unsigned long)macsec_p_ext->sci ^ | ~~~~~~~~~~~~^~~~~ 'napi_gro_frags': events 1-2 | | 773 | gro_result_t napi_gro_frags(struct napi_struct *napi) | | ^~~~~~~~~~~~~~ | | | | | (1) entry to 'napi_gro_frags' |...... | 776 | struct sk_buff *skb = napi_frags_skb(napi); | | ~~~~~~~~~~~~~~~~~~~~ | | | | | (2) calling 'napi_frags_skb' from 'napi_gro_frags' | +--> 'napi_frags_skb': events 3-6 | | 736 | static struct sk_buff *napi_frags_skb(struct napi_struct *napi) | | ^~~~~~~~~~~~~~ | | | | | (3) entry to 'napi_frags_skb' |...... | 747 | if (unlikely(skb_gro_header_hard(skb, hlen))) { | | ~ | | | | | (4) following 'true' branch... | 748 | eth = skb_gro_header_slow(skb, hlen, 0); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (5) ...to here | 749 | if (unlikely(!eth)) { | | ~ | | | | | (6) following 'true' branch... | 'napi_frags_skb': event 7 | |include/linux/net.h:265:13: | 265 | if (net_ratelimit()) \ | | ^~~~~~~~~~~~~~~ | | | | | (7) ...to here include/linux/net.h:280:9: note: in expansion of macro 'net_ratelimited_function' | 280 | net_ratelimited_function(pr_warn, fmt, ##__VA_ARGS__) | | ^~~~~~~~~~~~~~~~~~~~~~~~ net/core/gro.c:750:25: note: in expansion of macro 'net_warn_ratelimited' | 750 | net_warn_ratelimited("%s: dropping impossible skb from %s\n", | | ^~~~~~~~~~~~~~~~~~~~ | <------+ | 'napi_gro_frags': events 8-9 | | 776 | struct sk_buff *skb = napi_frags_skb(napi); | | ^~~~~~~~~~~~~~~~~~~~ | | | | | (8) returning to 'napi_gro_frags' from 'napi_frags_skb' |...... | 780 | ret = napi_frags_finish(napi, skb, dev_gro_receive(napi, skb)); | | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | | | | | (9) calling 'dev_gro_receive' from 'napi_gro_frags' | +--> 'dev_gro_receive': event 10 | | 487 | static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff *skb) | | ^~~~~~~~~~~~~~~ | | | | | (10) entry to 'dev_gro_receive' | 'dev_gro_receive': event 11 | |include/linux/netdevice.h:2340:12: | 2340 | if (!(dev->features & NETIF_F_GRO) || dev->xdp_prog) | | ^ | | | | | (11) following 'false' branch... | 'dev_gro_receive': events 12-13 | |net/core/gro.c:502:26: | 502 | gro_list_prepare(&gro_list->list, skb); | | ~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~ | | | | | | | (12) ...to here | | (13) calling 'gro_list_prepare' from 'dev_gro_receive' | +--> 'gro_list_prepare': event 14 | | 354 | static void gro_list_prepare(const struct list_head *head, | | ^~~~~~~~~~~~~~~~ | | | | | (14) entry to 'gro_list_prepare' | 'gro_list_prepare': event 15 | |include/linux/list.h:675:14: | 675 | !list_entry_is_head(pos, head, member); \ | | ^ | | | | | (15) following 'true' branch... vim +/macsec_p_ext +417 net/core/gro.c 587652bbdd06ab Eric Dumazet 2021-11-15 398 587652bbdd06ab Eric Dumazet 2021-11-15 399 diffs |= p->sk != skb->sk; 587652bbdd06ab Eric Dumazet 2021-11-15 400 diffs |= skb_metadata_dst_cmp(p, skb); 587652bbdd06ab Eric Dumazet 2021-11-15 401 diffs |= skb_get_nfct(p) ^ skb_get_nfct(skb); 587652bbdd06ab Eric Dumazet 2021-11-15 402 587652bbdd06ab Eric Dumazet 2021-11-15 403 #if IS_ENABLED(CONFIG_SKB_EXTENSIONS) && IS_ENABLED(CONFIG_NET_TC_SKB_EXT) 587652bbdd06ab Eric Dumazet 2021-11-15 404 skb_ext = skb_ext_find(skb, TC_SKB_EXT); 587652bbdd06ab Eric Dumazet 2021-11-15 405 p_ext = skb_ext_find(p, TC_SKB_EXT); 587652bbdd06ab Eric Dumazet 2021-11-15 406 587652bbdd06ab Eric Dumazet 2021-11-15 407 diffs |= (!!p_ext) ^ (!!skb_ext); 587652bbdd06ab Eric Dumazet 2021-11-15 408 if (!diffs && unlikely(skb_ext)) 587652bbdd06ab Eric Dumazet 2021-11-15 409 diffs |= p_ext->chain ^ skb_ext->chain; 9ee59a567b7907 Lior Nahmanson 2022-06-13 410 #endif 9ee59a567b7907 Lior Nahmanson 2022-06-13 411 #if IS_ENABLED(CONFIG_SKB_EXTENSIONS) && IS_ENABLED(CONFIG_MACSEC) 9ee59a567b7907 Lior Nahmanson 2022-06-13 412 macsec_skb_ext = skb_ext_find(skb, SKB_EXT_MACSEC); 9ee59a567b7907 Lior Nahmanson 2022-06-13 413 macsec_p_ext = skb_ext_find(p, SKB_EXT_MACSEC); 9ee59a567b7907 Lior Nahmanson 2022-06-13 414 9ee59a567b7907 Lior Nahmanson 2022-06-13 415 diffs |= (!!macsec_p_ext) ^ (!!macsec_skb_ext); 9ee59a567b7907 Lior Nahmanson 2022-06-13 416 if (!diffs && unlikely(macsec_skb_ext)) { 9ee59a567b7907 Lior Nahmanson 2022-06-13 @417 diffs |= (__force unsigned long)macsec_p_ext->sci ^ 9ee59a567b7907 Lior Nahmanson 2022-06-13 418 (__force unsigned long)macsec_skb_ext->sci; 9ee59a567b7907 Lior Nahmanson 2022-06-13 419 diffs |= macsec_p_ext->offloaded ^ macsec_skb_ext->offloaded; 9ee59a567b7907 Lior Nahmanson 2022-06-13 420 } 587652bbdd06ab Eric Dumazet 2021-11-15 421 #endif 587652bbdd06ab Eric Dumazet 2021-11-15 422 } 587652bbdd06ab Eric Dumazet 2021-11-15 423 587652bbdd06ab Eric Dumazet 2021-11-15 424 NAPI_GRO_CB(p)->same_flow = !diffs; 587652bbdd06ab Eric Dumazet 2021-11-15 425 } 587652bbdd06ab Eric Dumazet 2021-11-15 426 } 587652bbdd06ab Eric Dumazet 2021-11-15 427 -- 0-DAY CI Kernel Test Service https://01.org/lkp _______________________________________________ kbuild mailing list -- [email protected] To unsubscribe send an email to [email protected]
