From mboxrd@z Thu Jan  1 00:00:00 1970
From: David Ahern <dsahern@gmail.com>
Subject: Re: [Bug 199637] New: UBSAN: Undefined behaviour in
 net/ipv4/fib_trie.c:503:6
Date: Thu, 7 Jun 2018 18:27:01 -0700
Message-ID: <3972f02f-3dc4-c3ca-5354-d7a839f50782@gmail.com>
References: <20180507103345.08e3992d@xeon-e3>
 <20180607170759.176186fd@cakuba.netronome.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: netdev@vger.kernel.org, David Miller <davem@davemloft.net>
To: Jakub Kicinski <jakub.kicinski@netronome.com>,
        Stephen Hemminger <stephen@networkplumber.org>
Return-path: <netdev-owner@vger.kernel.org>
Received: from mail-pl0-f66.google.com ([209.85.160.66]:40430 "EHLO
        mail-pl0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752139AbeFHB1E (ORCPT
        <rfc822;netdev@vger.kernel.org>); Thu, 7 Jun 2018 21:27:04 -0400
Received: by mail-pl0-f66.google.com with SMTP id t12-v6so7228766plo.7
        for <netdev@vger.kernel.org>; Thu, 07 Jun 2018 18:27:04 -0700 (PDT)
In-Reply-To: <20180607170759.176186fd@cakuba.netronome.com>
Content-Language: en-US
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

On 6/7/18 5:07 PM, Jakub Kicinski wrote:

>> After recompiling the 4.16.7 kernel with gcc 8.1, UBSAN reports the following:
>>
>> [   25.427424]
>> ================================================================================
>> [   25.429680] UBSAN: Undefined behaviour in net/ipv4/fib_trie.c:503:6
>> [   25.431920] member access within null pointer of type 'struct tnode'
>> [   25.434153] CPU: 3 PID: 1 Comm: systemd Not tainted 4.16.7-CUSTOM #1
>> [   25.436384] Hardware name: Gigabyte Technology Co., Ltd.
>> H67MA-UD2H-B3/H67MA-UD2H-B3, BIOS F8 03/27/2012
>> [   25.438647] Call Trace:
>> [   25.440889]  dump_stack+0x62/0x9f
>> [   25.443104]  ubsan_epilogue+0x9/0x35
>> [   25.445293]  handle_null_ptr_deref+0x80/0x90
>> [   25.447464]  __ubsan_handle_type_mismatch_v1+0x6a/0x80
>> [   25.449628]  tnode_free+0xce/0x120

arguably this one should be guarded:

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 5bc0c89e81e4..32c589059fb3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -501,7 +501,8 @@ static void tnode_free(struct key_vector *tn)
                tnode_free_size += TNODE_SIZE(1ul << tn->bits);
                node_free(tn);

-               tn = container_of(head, struct tnode, rcu)->kv;
+               if (head)
+                       tn = container_of(head, struct tnode, rcu)->kv;
        }

        if (tnode_free_size >= PAGE_SIZE * sync_pages) {


but if head is NULL, tn is set but not dereferenced as the loop breaks.