From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1427872AbdDWIBV (ORCPT <rfc822;w@1wt.eu>);
        Sun, 23 Apr 2017 04:01:21 -0400
Received: from m50-135.163.com ([123.125.50.135]:47221 "EHLO m50-135.163.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1427852AbdDWIBN (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Sun, 23 Apr 2017 04:01:13 -0400
Date: Sun, 23 Apr 2017 16:00:27 +0800
From: PanBian <bianpan2016@163.com>
To: Joe Perches <joe@perches.com>
Cc: Ying Xue <ying.xue@windriver.com>,
        "David S. Miller" <davem@davemloft.net>, netdev@vger.kernel.org,
        tipc-discussion@lists.sourceforge.net, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/1] tipc: check return value of nlmsg_new
Message-ID: <20170423080027.GA843@bp>
Reply-To: PanBian <bianpan2016@163.com>
References: <1492931359-25004-1-git-send-email-bianpan2016@163.com>
 <1492931836.30293.43.camel@perches.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1492931836.30293.43.camel@perches.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
X-CM-TRANSID: D9GowADX_mYbX_xYyth5AA--.325S2
X-Coremail-Antispam: 1Uf129KBjvdXoW7Gr43GF4UXF1xAFyUtF4ruFg_yoWkCrX_Wr
        9FqFs3G34qqr13Ar13KFW5trySg3y8Aa47A3ykWw12y3W5J3yDGFykJr9a9FWxGryIvFn0
        gFs8CasI934a9jkaLaAFLSUrUUUUUb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT
        9fnUUvcSsGvfC2KfnxnUUI43ZEXa7IU0-B_UUUUUU==
X-Originating-IP: [123.118.194.153]
X-CM-SenderInfo: held01tdqsiiqw6rljoofrz/1tbiQBvCclSISvMI9gAAsw
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sun, Apr 23, 2017 at 12:17:16AM -0700, Joe Perches wrote:
> On Sun, 2017-04-23 at 15:09 +0800, Pan Bian wrote:
> > Function nlmsg_new() will return a NULL pointer if there is no enough
> > memory, and its return value should be checked before it is used.
> > However, in function tipc_nl_node_get_monitor(), the validation of the
> > return value of function nlmsg_new() is missed. This patch fixes the
> > bug.
> 
> Hello.
> 
> Thanks for the patches.
> 
> Are you finding these via a tool or inspection?
> 
> If a tool is being used, could you please describe it?
> 

Yes. I developed a tool to find this kind of bugs.

The detecting idea is simple. In large systems like the Linux kernel, 
most implementations are correct, and incorrect ones are rare. Based on
this observation, we take programs that have different implementations
with others as bugs. For example, in most cases, the return vlaue of
nlmsg_new() is validated and it will not be passed to genlmsg_reply() if
its value is NULL. However, in function tipc_nl_node_get_monitor(), the
validation is missing. The abnormal behavior leads us to believe that
there is a bug.


Thanks for your attention.