Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Thu, 23 Sep 2021 17:37:28 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Paolo Abeni <pabeni@redhat.com>
Cc:     syzbot <syzbot+263a248eec3e875baa7b@syzkaller.appspotmail.com>,
        davem@davemloft.net, kuba@kernel.org, linux-kernel@vger.kernel.org,
        mathew.j.martineau@linux.intel.com, matthieu.baerts@tessares.net,
        mptcp@lists.linux.dev, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] WARNING in mptcp_sendmsg_frag
Message-ID: <20210923143728.GD2083@kadam>
References: <00000000000015991c05cc43a736@google.com>
 <7de92627f85522bf5640defe16eee6c8825f5c55.camel@redhat.com>
 <20210923141942.GD2048@kadam>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210923141942.GD2048@kadam>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?zgwqXFSitB4z61V7mQU73EUplaCAGe4HJLEStLTdYbnLxxv54JHDiyQeuGFc?=
 =?us-ascii?Q?R8qJCbyuGv1fy950bkisPmK5YZqYrSDiSbayTq8WuOu1CHBARzWzwFPXOYQX?=
 =?us-ascii?Q?sY0avXWe3WDf3JazvNti09m6SezedoK/u2nJdhaKs3qJ41pejl9YLWFh5v0N?=
 =?us-ascii?Q?JZkEM7oMPhQuEN2tMtYUAHkja6lLC4tq9d6Vtu6HjxMzcteWOvs5ls0XFoTb?=
 =?us-ascii?Q?ptYgoqQ8WvGFdFTufYSxpJmi1Es9wh2GoRDhwqlW+rTciabuwWJoVXDMfUbq?=
 =?us-ascii?Q?wM8R+9MvEYqKhOxiDhBFB38pBAVquWZ3+eHnVi9aQK7CWsw+G83OrhF3w88B?=
 =?us-ascii?Q?G5dapqmXfZOJLiuUOp532WzCWqAKdROQJ2RJZ6OKc+8Xi+TBLsgeF1P31Zjv?=
 =?us-ascii?Q?uiS+JtG7NKnyV0xqQ+cuRL9ep1dSgEP52gvLgGsNtCS5TdrFqY1AL3s046QG?=
 =?us-ascii?Q?qBz6juq5Kuv9zpniHYuBwSLb4uSOe6IVMKFKjjqkURTxxOKTlIBr/qi9Mi3/?=
 =?us-ascii?Q?cKOni6nD7bLZ791Ks9PZFGFvQIZsmkOShqllJfEQCsB6sqN7IoQ7PpMv3Zsh?=
 =?us-ascii?Q?CVmt3yNV2w8rN0nZLSJjoU2vJwnpsAgj4rfJuOIaDmTCdR1AfzGR8w8AOSa8?=
 =?us-ascii?Q?5Dx8XBMMGc77oDdLU5TXkciYhcYTZf7FePheAIrFtuedAWjYrp/bR9t13oVi?=
 =?us-ascii?Q?JpHj6vSTB47K8oUcf9CUvBfoWCrrWu06hzuCbt3rksLBAFa4ws48Y17R5lEn?=
 =?us-ascii?Q?xUTKb40ZHeaF1eFqA9cLQEMA7yKL6QkwObeDOzLqEQb+1UmJPZaCJd/uP52M?=
 =?us-ascii?Q?yLsmwNiQ8WtA90LOp426viOqkpP7ZJjmmHyKmT3lsnCc9Igz1vvr+6waZaK9?=
 =?us-ascii?Q?GHgRAptY5ylyuas2+C1RCDl8Kk170m9eNy6M8tpruxdsuDawSC2S/tbrVfhQ?=
 =?us-ascii?Q?9yOAB4ljmJbh6mHFbDoC/X+3Qvhw6FaHficT6pvmhBUcW0XUJmoNkL0rVYYg?=
 =?us-ascii?Q?JlnqXiP5q8xxVZNCswaicfBOVAdvVuQaw+er9tz9n4hK2Jre2wnVEOCs1ksw?=
 =?us-ascii?Q?yDAS3GsH2mS7OfOpbxdVUj0GaHDM4YWXVegZJKslPe4lXprjuj7Sdt8rLMeV?=
 =?us-ascii?Q?qepzR65MRk0cJteIEsIlcqIacrpvOkO4tBPKxGXpP0tHhTFX+4nKs+qhf6xT?=
 =?us-ascii?Q?N3b8KzMWQ2VGxOIyM5m+Df1XNyt34+Q0ob1eeYADILRMFNrLNyqgEvOYsBXs?=
 =?us-ascii?Q?O9EN+gUi0u8G9Zton9z+sqjTFGXlRtOQeW6FDjK3rIa50QbAuWMKSXTuvIYL?=
 =?us-ascii?Q?ZVWf99FoNMSzkXzyACnXhGyo?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c81792d6-24c0-4588-ecd0-08d97e9fb574
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Sep 2021 14:37:46.0353
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 6e+UTHr93XXPIinEvkakJYvsSNfmH5JSIK2MFKQUvLpsWkgGGB3W3AVwifoewT3Y7uetqpUUreWvtzO0dsOHKrbaR+1GGEK/YKZQ6veUZY4=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1001MB2208
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10115 signatures=668682
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 suspectscore=0 bulkscore=0
 malwarescore=0 mlxscore=0 mlxlogscore=999 spamscore=0 phishscore=0
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2109200000
 definitions=main-2109230091
X-Proofpoint-GUID: VJCu1dsLHIUTJlWKBeZoEaL8_iWuaEqe
X-Proofpoint-ORIG-GUID: VJCu1dsLHIUTJlWKBeZoEaL8_iWuaEqe
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Sep 23, 2021 at 05:19:42PM +0300, Dan Carpenter wrote:
> On Wed, Sep 22, 2021 at 12:32:56PM +0200, Paolo Abeni wrote:
> > 
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> > 
> > The debug code helped a bit. It looks like we have singed/unsigned
> > comparisons issue
> 
> There should be a static checker warning for these.  I have created one
> in response to your email.  It turns out there are a couple other
> instances of this bug in the same file.
> 
> net/mptcp/protocol.c:479 mptcp_subflow_could_cleanup() warn: unsigned subtraction: '(null)' use '!='

I should have checked my output a bit more carefully.  I don't want this
one to generate a warning.

> net/mptcp/protocol.c:909 mptcp_frag_can_collapse_to() warn: unsigned subtraction: 'pfrag->size - pfrag->offset' use '!='

Likely "pfrag->offset" can't be larger than "pfrag->size".  Smatch has
some code to try track this information but it's not clever enough.

regards,
dan carpenter