Re: [PATCH V4 net-next 5/5] icmp: add response to RFC 8335 PROBE messages

[kernel test robot <lkp@intel.com>]

[-- Attachment #1: Type: text/plain, Size: 5989 bytes --]

Hi Andreas,

[FYI, it's a private test report for your RFC patch.]
[auto build test WARNING on net-next/master]

url:    https://github.com/0day-ci/linux/commits/Andreas-Roeseler/add-support-for-RFC-8335-PROBE/20210315-005052
base:   https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git 6f1629093399303bf19d6fcd5144061d1e25ec23
config: x86_64-randconfig-m001-20210314 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

smatch warnings:
net/ipv4/icmp.c:1040 icmp_echo() warn: signedness bug returning '(-12)'

vim +1040 net/ipv4/icmp.c

   976	
   977	/*
   978	 *	Handle ICMP_ECHO ("ping") and ICMP_EXT_ECHO ("PROBE") requests.
   979	 *
   980	 *	RFC 1122: 3.2.2.6 MUST have an echo server that answers ICMP echo
   981	 *		  requests.
   982	 *	RFC 1122: 3.2.2.6 Data received in the ICMP_ECHO request MUST be
   983	 *		  included in the reply.
   984	 *	RFC 1812: 4.3.3.6 SHOULD have a config option for silently ignoring
   985	 *		  echo requests, MUST have default=NOT.
   986	 *	RFC 8335: 8 MUST have a config option to enable/disable ICMP
   987	 *		  Extended Echo Functionality, MUST be disabled by default
   988	 *	See also WRT handling of options once they are done and working.
   989	 */
   990	
   991	static bool icmp_echo(struct sk_buff *skb)
   992	{
   993		struct icmp_ext_hdr *ext_hdr, _ext_hdr;
   994		struct icmp_ext_echo_iio *iio, _iio;
   995		struct icmp_bxm icmp_param;
   996		struct net_device *dev;
   997		struct net *net;
   998		u16 ident_len;
   999		char *buff;
  1000		u8 status;
  1001	
  1002		net = dev_net(skb_dst(skb)->dev);
  1003		/* should there be an ICMP stat for ignored echos? */
  1004		if (net->ipv4.sysctl_icmp_echo_ignore_all)
  1005			return true;
  1006	
  1007		icmp_param.data.icmph	   = *icmp_hdr(skb);
  1008		icmp_param.skb		   = skb;
  1009		icmp_param.offset	   = 0;
  1010		icmp_param.data_len	   = skb->len;
  1011		icmp_param.head_len	   = sizeof(struct icmphdr);
  1012	
  1013		if (icmp_param.data.icmph.type == ICMP_ECHO)
  1014			goto send_reply;
  1015		if (!net->ipv4.sysctl_icmp_echo_enable_probe)
  1016			return true;
  1017		/* We currently only support probing interfaces on the proxy node
  1018		 * Check to ensure L-bit is set
  1019		 */
  1020		if (!(ntohs(icmp_param.data.icmph.un.echo.sequence) & 1))
  1021			return true;
  1022		/* Clear status bits in reply message */
  1023		icmp_param.data.icmph.un.echo.sequence &= htons(0xFF00);
  1024		icmp_param.data.icmph.type = ICMP_EXT_ECHOREPLY;
  1025		ext_hdr = skb_header_pointer(skb, 0, sizeof(_ext_hdr), &_ext_hdr);
  1026		iio = skb_header_pointer(skb, sizeof(_ext_hdr), sizeof(_iio), &_iio);
  1027		if (!ext_hdr || !iio)
  1028			goto send_mal_query;
  1029		if (ntohs(iio->extobj_hdr.length) <= sizeof(iio->extobj_hdr))
  1030			goto send_mal_query;
  1031		ident_len = ntohs(iio->extobj_hdr.length) - sizeof(iio->extobj_hdr);
  1032		status = 0;
  1033		dev = NULL;
  1034		switch (iio->extobj_hdr.class_type) {
  1035		case EXT_ECHO_CTYPE_NAME:
  1036			if (ident_len >= IFNAMSIZ)
  1037				goto send_mal_query;
  1038			buff = kcalloc(IFNAMSIZ, sizeof(char), GFP_KERNEL);
  1039			if (!buff)
> 1040				return -ENOMEM;
  1041			memcpy(buff, &iio->ident.name, ident_len);
  1042			/* RFC 8335 2.1 If the Object Payload would not otherwise terminate
  1043			 * on a 32-bit boundary, it MUST be padded with ASCII NULL characters
  1044			 */
  1045			if (ident_len % sizeof(u32) != 0) {
  1046				u8 i;
  1047	
  1048				for (i = ident_len; i % sizeof(u32) != 0; i++) {
  1049					if (buff[i] != '\0')
  1050						goto send_mal_query;
  1051				}
  1052			}
  1053			dev = dev_get_by_name(net, buff);
  1054			kfree(buff);
  1055			break;
  1056		case EXT_ECHO_CTYPE_INDEX:
  1057			if (ident_len != sizeof(iio->ident.ifindex))
  1058				goto send_mal_query;
  1059			dev = dev_get_by_index(net, ntohl(iio->ident.ifindex));
  1060			break;
  1061		case EXT_ECHO_CTYPE_ADDR:
  1062			if (ident_len != sizeof(iio->ident.addr.ctype3_hdr) + iio->ident.addr.ctype3_hdr.addrlen)
  1063				goto send_mal_query;
  1064			switch (ntohs(iio->ident.addr.ctype3_hdr.afi)) {
  1065			case ICMP_AFI_IP:
  1066				if (ident_len != sizeof(iio->ident.addr.ctype3_hdr) + sizeof(struct in_addr))
  1067					goto send_mal_query;
  1068				dev = ip_dev_find(net, iio->ident.addr.ip_addr.ipv4_addr.s_addr);
  1069				break;
  1070	#if IS_ENABLED(CONFIG_IPV6)
  1071			case ICMP_AFI_IP6:
  1072				if (ident_len != sizeof(iio->ident.addr.ctype3_hdr) + sizeof(struct in6_addr))
  1073					goto send_mal_query;
  1074				rcu_read_lock();
  1075				dev = ipv6_dev_find(net, &iio->ident.addr.ip_addr.ipv6_addr, dev);
  1076				if (dev)
  1077					dev_hold(dev);
  1078				rcu_read_unlock();
  1079				break;
  1080	#endif
  1081			default:
  1082				goto send_mal_query;
  1083			}
  1084			break;
  1085		default:
  1086			goto send_mal_query;
  1087		}
  1088		if (!dev) {
  1089			icmp_param.data.icmph.code = ICMP_EXT_NO_IF;
  1090			goto send_reply;
  1091		}
  1092		/* Fill bits in reply message */
  1093		if (dev->flags & IFF_UP)
  1094			status |= EXT_ECHOREPLY_ACTIVE;
  1095		if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list)
  1096			status |= EXT_ECHOREPLY_IPV4;
  1097		if (!list_empty(&dev->ip6_ptr->addr_list))
  1098			status |= EXT_ECHOREPLY_IPV6;
  1099		dev_put(dev);
  1100		icmp_param.data.icmph.un.echo.sequence |= htons(status);
  1101	send_reply:
  1102		icmp_reply(&icmp_param, skb);
  1103			return true;
  1104	send_mal_query:
  1105		icmp_param.data.icmph.code = ICMP_EXT_MAL_QUERY;
  1106		goto send_reply;
  1107	}
  1108	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 34771 bytes --]