[bug report] mctp: Add route input to socket tests

[bug report] mctp: Add route input to socket tests

[Dan Carpenter]

Hello Jeremy Kerr,

The patch 8892c0490779: "mctp: Add route input to socket tests" from
Oct 3, 2021, leads to the following Smatch static checker warning:

	net/mctp/test/route-test.c:357 mctp_test_route_input_sk()
	error: dereferencing freed memory 'skb'

net/mctp/test/route-test.c
    331 static void mctp_test_route_input_sk(struct kunit *test)
    332 {
    333         const struct mctp_route_input_sk_test *params;
    334         struct sk_buff *skb, *skb2;
    335         struct mctp_test_route *rt;
    336         struct mctp_test_dev *dev;
    337         struct socket *sock;
    338         int rc;
    339 
    340         params = test->param_value;
    341 
    342         __mctp_route_test_init(test, &dev, &rt, &sock);
    343 
    344         skb = mctp_test_create_skb_data(&params->hdr, &params->type);
    345         KUNIT_ASSERT_NOT_ERR_OR_NULL(test, skb);
    346 
    347         skb->dev = dev->ndev;
    348         __mctp_cb(skb);
    349 
    350         rc = mctp_route_input(&rt->rt, skb);
                                               ^^^
Freed here.

    351 
    352         if (params->deliver) {
    353                 KUNIT_EXPECT_EQ(test, rc, 0);
    354 
    355                 skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
    356                 KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2);
--> 357                 KUNIT_EXPECT_EQ(test, skb->len, 1);
                                              ^^^
Use after free.

    358 
    359                 skb_free_datagram(sock->sk, skb2);
    360 
    361         } else {
    362                 KUNIT_EXPECT_NE(test, rc, 0);
    363                 skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
    364                 KUNIT_EXPECT_NULL(test, skb2);
    365         }
    366 
    367         __mctp_route_test_fini(test, dev, rt, sock);
    368 }

regards,
dan carpenter

Re: [bug report] mctp: Add route input to socket tests

[Jeremy Kerr]

Hi Dan,

> The patch 8892c0490779: "mctp: Add route input to socket tests" from
> Oct 3, 2021, leads to the following Smatch static checker warning:
> 
>         net/mctp/test/route-test.c:357 mctp_test_route_input_sk()
>         error: dereferencing freed memory 'skb'

[...]

>     351 
>     352         if (params->deliver) {
>     353                 KUNIT_EXPECT_EQ(test, rc, 0);
>     354 
>     355                 skb2 = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
>     356                 KUNIT_EXPECT_NOT_ERR_OR_NULL(test, skb2);
> --> 357                 KUNIT_EXPECT_EQ(test, skb->len, 1);
>                                               ^^^
> Use after free.

Yep, that should be skb2.

Thanks for the report! I'll send a fix soon.

Cheers,


Jeremy