* [net-next:master 2/15] net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
@ 2021-08-05 11:57 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: kernel test robot @ 2021-08-05 8:54 UTC (permalink / raw)
To: kbuild
[-- Attachment #1: Type: text/plain, Size: 3033 bytes --]
CC: kbuild-all(a)lists.01.org
CC: netdev(a)vger.kernel.org
TO: Rao Shoaib <rao.shoaib@oracle.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
head: c2eecaa193ff1e516a1b389637169ae86a6fa867
commit: 314001f0bf927015e459c9d387d62a231fe93af3 [2/15] af_unix: Add OOB support
:::::: branch date: 21 hours ago
:::::: commit date: 24 hours ago
config: nios2-randconfig-m031-20210804 (attached as .config)
compiler: nios2-linux-gcc (GCC) 10.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
New smatch warnings:
net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
Old smatch warnings:
arch/nios2/include/asm/thread_info.h:71 current_thread_info() error: uninitialized symbol 'sp'.
vim +/skb +2471 net/unix/af_unix.c
314001f0bf9270 Rao Shoaib 2021-08-01 2445
314001f0bf9270 Rao Shoaib 2021-08-01 2446 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
314001f0bf9270 Rao Shoaib 2021-08-01 2447 int flags, int copied)
314001f0bf9270 Rao Shoaib 2021-08-01 2448 {
314001f0bf9270 Rao Shoaib 2021-08-01 2449 struct unix_sock *u = unix_sk(sk);
314001f0bf9270 Rao Shoaib 2021-08-01 2450
314001f0bf9270 Rao Shoaib 2021-08-01 2451 if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2452 skb_unlink(skb, &sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2453 consume_skb(skb);
314001f0bf9270 Rao Shoaib 2021-08-01 2454 skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2455 } else {
314001f0bf9270 Rao Shoaib 2021-08-01 2456 if (skb == u->oob_skb) {
314001f0bf9270 Rao Shoaib 2021-08-01 2457 if (copied) {
314001f0bf9270 Rao Shoaib 2021-08-01 2458 skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2459 } else if (sock_flag(sk, SOCK_URGINLINE)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2460 if (!(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2461 u->oob_skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2462 consume_skb(skb);
314001f0bf9270 Rao Shoaib 2021-08-01 2463 }
314001f0bf9270 Rao Shoaib 2021-08-01 2464 } else if (!(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2465 skb_unlink(skb, &sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2466 consume_skb(skb);
314001f0bf9270 Rao Shoaib 2021-08-01 2467 skb = skb_peek(&sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2468 }
314001f0bf9270 Rao Shoaib 2021-08-01 2469 }
314001f0bf9270 Rao Shoaib 2021-08-01 2470 }
314001f0bf9270 Rao Shoaib 2021-08-01 @2471 return skb;
314001f0bf9270 Rao Shoaib 2021-08-01 2472 }
314001f0bf9270 Rao Shoaib 2021-08-01 2473 #endif
314001f0bf9270 Rao Shoaib 2021-08-01 2474
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 32190 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread* [net-next:master 2/15] net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
@ 2021-08-05 11:57 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2021-08-05 11:57 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 2647 bytes --]
tree: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
head: c2eecaa193ff1e516a1b389637169ae86a6fa867
commit: 314001f0bf927015e459c9d387d62a231fe93af3 [2/15] af_unix: Add OOB support
config: nios2-randconfig-m031-20210804 (attached as .config)
compiler: nios2-linux-gcc (GCC) 10.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
New smatch warnings:
net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
vim +/skb +2471 net/unix/af_unix.c
314001f0bf9270 Rao Shoaib 2021-08-01 2446 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
314001f0bf9270 Rao Shoaib 2021-08-01 2447 int flags, int copied)
314001f0bf9270 Rao Shoaib 2021-08-01 2448 {
314001f0bf9270 Rao Shoaib 2021-08-01 2449 struct unix_sock *u = unix_sk(sk);
314001f0bf9270 Rao Shoaib 2021-08-01 2450
314001f0bf9270 Rao Shoaib 2021-08-01 2451 if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2452 skb_unlink(skb, &sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2453 consume_skb(skb);
314001f0bf9270 Rao Shoaib 2021-08-01 2454 skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2455 } else {
314001f0bf9270 Rao Shoaib 2021-08-01 2456 if (skb == u->oob_skb) {
314001f0bf9270 Rao Shoaib 2021-08-01 2457 if (copied) {
314001f0bf9270 Rao Shoaib 2021-08-01 2458 skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2459 } else if (sock_flag(sk, SOCK_URGINLINE)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2460 if (!(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2461 u->oob_skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2462 consume_skb(skb);
Need to set "skb = NULL;" after the consume.
314001f0bf9270 Rao Shoaib 2021-08-01 2463 }
314001f0bf9270 Rao Shoaib 2021-08-01 2464 } else if (!(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2465 skb_unlink(skb, &sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2466 consume_skb(skb);
314001f0bf9270 Rao Shoaib 2021-08-01 2467 skb = skb_peek(&sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2468 }
314001f0bf9270 Rao Shoaib 2021-08-01 2469 }
314001f0bf9270 Rao Shoaib 2021-08-01 2470 }
314001f0bf9270 Rao Shoaib 2021-08-01 @2471 return skb;
314001f0bf9270 Rao Shoaib 2021-08-01 2472 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
^ permalink raw reply [flat|nested] 5+ messages in thread* [net-next:master 2/15] net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
@ 2021-08-05 11:57 ` Dan Carpenter
0 siblings, 0 replies; 5+ messages in thread
From: Dan Carpenter @ 2021-08-05 11:57 UTC (permalink / raw)
To: kbuild, Rao Shoaib; +Cc: lkp, kbuild-all, netdev
tree: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
head: c2eecaa193ff1e516a1b389637169ae86a6fa867
commit: 314001f0bf927015e459c9d387d62a231fe93af3 [2/15] af_unix: Add OOB support
config: nios2-randconfig-m031-20210804 (attached as .config)
compiler: nios2-linux-gcc (GCC) 10.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
New smatch warnings:
net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
vim +/skb +2471 net/unix/af_unix.c
314001f0bf9270 Rao Shoaib 2021-08-01 2446 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
314001f0bf9270 Rao Shoaib 2021-08-01 2447 int flags, int copied)
314001f0bf9270 Rao Shoaib 2021-08-01 2448 {
314001f0bf9270 Rao Shoaib 2021-08-01 2449 struct unix_sock *u = unix_sk(sk);
314001f0bf9270 Rao Shoaib 2021-08-01 2450
314001f0bf9270 Rao Shoaib 2021-08-01 2451 if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2452 skb_unlink(skb, &sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2453 consume_skb(skb);
314001f0bf9270 Rao Shoaib 2021-08-01 2454 skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2455 } else {
314001f0bf9270 Rao Shoaib 2021-08-01 2456 if (skb == u->oob_skb) {
314001f0bf9270 Rao Shoaib 2021-08-01 2457 if (copied) {
314001f0bf9270 Rao Shoaib 2021-08-01 2458 skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2459 } else if (sock_flag(sk, SOCK_URGINLINE)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2460 if (!(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2461 u->oob_skb = NULL;
314001f0bf9270 Rao Shoaib 2021-08-01 2462 consume_skb(skb);
Need to set "skb = NULL;" after the consume.
314001f0bf9270 Rao Shoaib 2021-08-01 2463 }
314001f0bf9270 Rao Shoaib 2021-08-01 2464 } else if (!(flags & MSG_PEEK)) {
314001f0bf9270 Rao Shoaib 2021-08-01 2465 skb_unlink(skb, &sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2466 consume_skb(skb);
314001f0bf9270 Rao Shoaib 2021-08-01 2467 skb = skb_peek(&sk->sk_receive_queue);
314001f0bf9270 Rao Shoaib 2021-08-01 2468 }
314001f0bf9270 Rao Shoaib 2021-08-01 2469 }
314001f0bf9270 Rao Shoaib 2021-08-01 2470 }
314001f0bf9270 Rao Shoaib 2021-08-01 @2471 return skb;
314001f0bf9270 Rao Shoaib 2021-08-01 2472 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [net-next:master 2/15] net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
2021-08-05 11:57 ` Dan Carpenter
@ 2021-08-06 17:22 ` Shoaib Rao
-1 siblings, 0 replies; 5+ messages in thread
From: Shoaib Rao @ 2021-08-06 17:22 UTC (permalink / raw)
To: Dan Carpenter, kbuild; +Cc: lkp, kbuild-all, netdev
This is a false positive. consume_skb does necessarily frees the skb, it
decrements the refcnt abd if no reference exists frees the skb. In this
case skb will not be freed. I used consume_skb as that is what the code
uses.
Shoaib.
On 8/5/21 4:57 AM, Dan Carpenter wrote:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
> head: c2eecaa193ff1e516a1b389637169ae86a6fa867
> commit: 314001f0bf927015e459c9d387d62a231fe93af3 [2/15] af_unix: Add OOB support
> config: nios2-randconfig-m031-20210804 (attached as .config)
> compiler: nios2-linux-gcc (GCC) 10.3.0
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> New smatch warnings:
> net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
>
> vim +/skb +2471 net/unix/af_unix.c
>
> 314001f0bf9270 Rao Shoaib 2021-08-01 2446 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
> 314001f0bf9270 Rao Shoaib 2021-08-01 2447 int flags, int copied)
> 314001f0bf9270 Rao Shoaib 2021-08-01 2448 {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2449 struct unix_sock *u = unix_sk(sk);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2450
> 314001f0bf9270 Rao Shoaib 2021-08-01 2451 if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2452 skb_unlink(skb, &sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2453 consume_skb(skb);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2454 skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2455 } else {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2456 if (skb == u->oob_skb) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2457 if (copied) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2458 skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2459 } else if (sock_flag(sk, SOCK_URGINLINE)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2460 if (!(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2461 u->oob_skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2462 consume_skb(skb);
>
> Need to set "skb = NULL;" after the consume.
>
> 314001f0bf9270 Rao Shoaib 2021-08-01 2463 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 2464 } else if (!(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2465 skb_unlink(skb, &sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2466 consume_skb(skb);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2467 skb = skb_peek(&sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2468 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 2469 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 2470 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 @2471 return skb;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2472 }
>
> ---
> 0-DAY CI Kernel Test Service, Intel Corporation
> https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [net-next:master 2/15] net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
@ 2021-08-06 17:22 ` Shoaib Rao
0 siblings, 0 replies; 5+ messages in thread
From: Shoaib Rao @ 2021-08-06 17:22 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 3021 bytes --]
This is a false positive. consume_skb does necessarily frees the skb, it
decrements the refcnt abd if no reference exists frees the skb. In this
case skb will not be freed. I used consume_skb as that is what the code
uses.
Shoaib.
On 8/5/21 4:57 AM, Dan Carpenter wrote:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git master
> head: c2eecaa193ff1e516a1b389637169ae86a6fa867
> commit: 314001f0bf927015e459c9d387d62a231fe93af3 [2/15] af_unix: Add OOB support
> config: nios2-randconfig-m031-20210804 (attached as .config)
> compiler: nios2-linux-gcc (GCC) 10.3.0
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> New smatch warnings:
> net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb'
>
> vim +/skb +2471 net/unix/af_unix.c
>
> 314001f0bf9270 Rao Shoaib 2021-08-01 2446 static struct sk_buff *manage_oob(struct sk_buff *skb, struct sock *sk,
> 314001f0bf9270 Rao Shoaib 2021-08-01 2447 int flags, int copied)
> 314001f0bf9270 Rao Shoaib 2021-08-01 2448 {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2449 struct unix_sock *u = unix_sk(sk);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2450
> 314001f0bf9270 Rao Shoaib 2021-08-01 2451 if (!unix_skb_len(skb) && !(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2452 skb_unlink(skb, &sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2453 consume_skb(skb);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2454 skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2455 } else {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2456 if (skb == u->oob_skb) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2457 if (copied) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2458 skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2459 } else if (sock_flag(sk, SOCK_URGINLINE)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2460 if (!(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2461 u->oob_skb = NULL;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2462 consume_skb(skb);
>
> Need to set "skb = NULL;" after the consume.
>
> 314001f0bf9270 Rao Shoaib 2021-08-01 2463 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 2464 } else if (!(flags & MSG_PEEK)) {
> 314001f0bf9270 Rao Shoaib 2021-08-01 2465 skb_unlink(skb, &sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2466 consume_skb(skb);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2467 skb = skb_peek(&sk->sk_receive_queue);
> 314001f0bf9270 Rao Shoaib 2021-08-01 2468 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 2469 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 2470 }
> 314001f0bf9270 Rao Shoaib 2021-08-01 @2471 return skb;
> 314001f0bf9270 Rao Shoaib 2021-08-01 2472 }
>
> ---
> 0-DAY CI Kernel Test Service, Intel Corporation
> https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-08-06 17:22 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-05 8:54 [net-next:master 2/15] net/unix/af_unix.c:2471 manage_oob() warn: returning freed memory 'skb' kernel test robot
2021-08-05 11:57 ` Dan Carpenter
2021-08-05 11:57 ` Dan Carpenter
2021-08-06 17:22 ` Shoaib Rao
2021-08-06 17:22 ` Shoaib Rao
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.