Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 18 Jan 2022 15:33:26 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     kbuild@lists.01.org, Jiasheng Jiang <jiasheng@iscas.ac.cn>,
        keescook@chromium.org, arnd@arndb.de, gregkh@linuxfoundation.org
Cc:     lkp@intel.com, kbuild-all@lists.01.org,
        linux-kernel@vger.kernel.org, Jiasheng Jiang <jiasheng@iscas.ac.cn>
Subject: Re: [PATCH] lkdtm/bugs: Check for the NULL pointer after calling
 kmalloc
Message-ID: <202201150641.NvpCoUdU-lkp@intel.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220114082119.1270966-1-jiasheng@iscas.ac.cn>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?QFAiX11DFslTOr6IxmVWDPpZtj9FnD9LX8t1PApW81NSVsrB80mX7nY4c0Me?=
 =?us-ascii?Q?yPWJOMNVvKWrGWj2x7AgeCMVk8tDD+9FZmKlaFHy3wiT0dJIehXHSIUfZSEw?=
 =?us-ascii?Q?caaQF6yTo3ASFpENLaMqlnn/vVE0c1861Kr9d8WDHnr30WxV8JmJBLkY8SiC?=
 =?us-ascii?Q?coaNnHokOURZK1FkwN5hXJHGQLN3FFOaBWrdEVdT+Ad7P8rI88tRHzZ4EvA0?=
 =?us-ascii?Q?w0Mf5aHOA4VNmZ0jk2YSoB7m2Vj7v8ep/xYIzapFExjLntf9+vahayiul0O8?=
 =?us-ascii?Q?XNbH5cgcKXFPVAR/81j4NpKKEnUvD69JNObmjvy9YnlG316qttJ1xhiGMTzl?=
 =?us-ascii?Q?N7XQkc5zhdWP3d8QwlqY0AVjjyM8DheAuHRLvAfLuHP3Xxi2mr8LS4MatplD?=
 =?us-ascii?Q?BtsNTfsz+r4ARn+WNUedzdVsHtoI2HyMGNvXfuMSVCBAyg76Gqyg5jK/h4Or?=
 =?us-ascii?Q?+/xpNNQW6/xxA9L7xSu43E+WbgoZVDwsAIW4j5IEYxNOM/3NAFbOhit3isbd?=
 =?us-ascii?Q?acZad7x0rjaZclhv6a7n4MRpxWnVwlvtX5fsfRp2a1ZRAQY8kdZRwuP3PTFq?=
 =?us-ascii?Q?qrdO7umKCA0BwD8eu8H8ZQHwCGIJ84zphKjoMt/aWkIGr2HG6HfRBzCJmPfK?=
 =?us-ascii?Q?GYqBuOWzHbvwMOngIIsiPg6J8C1vdY2A7BwhXKA/9vFkADEa5OMRoKAR+ZCA?=
 =?us-ascii?Q?xx4UgIgSTI1vw2LJj3glMThG3s/QZxHvr9yM5TJYV9qB8UmzjYqB7ZYHuIDX?=
 =?us-ascii?Q?qyYkou/DF8nPG29YHPj1mWzxeGRcEEOa+6YCVbPRPHTcpF+uWIaULcie2DHB?=
 =?us-ascii?Q?M1KkqelMyKmpim8/L7dMIGGl37EGYvQEdJS1bkVRshW3WRboXoHL46oCuBYi?=
 =?us-ascii?Q?VbG7Rh1FeiQfZtmlt0wd6JDxOorV19JtgfSQuUqm/HOHApL9npbD9VHt+N7N?=
 =?us-ascii?Q?JpY6eEAth/j0Ivm3J16mM8PzXl8uPDSVxjR3i7b4ahTeI6Q5XE0ogmXzPaMw?=
 =?us-ascii?Q?xNY8nimUoxdDZzdlLn2IcRxjuen4K5WGi/Gr5CMPaJ6Y0OMuSYDqKkLjYcD6?=
 =?us-ascii?Q?9M/+L+0EHKmgGZmCYXgQhnhI8BqecRtqDkB1PxJTF1Dmfuz7unmavJo89RH6?=
 =?us-ascii?Q?sGWpoCD/6TKxuy94I7sOD2lgc/BqTxKvpBSQKIJc3l7Or++OQnPEvnU8Uyqm?=
 =?us-ascii?Q?ilNjNEM79VilE/I8vJFPKnWT90EpRLu1oth832uQtV7WtiaQbeJJN/LROw/O?=
 =?us-ascii?Q?FxsV1LJIvkzgNeJpoD88SQBXJ/tPP23nh/ffrTwIsaO8tLFHm8WrEf/V9HwL?=
 =?us-ascii?Q?PXu/cPR5vESDXSv+EwId0IG+Lj6BjXWQnXhfjEQZCXbIHHLZbqgoZtMjwRY6?=
 =?us-ascii?Q?PcTW59oXS5rWob5XF/yAzjCrtiE4PvcEHHH2eIuYvHDqz4Rlc77hlivSqt6o?=
 =?us-ascii?Q?gqLxC7IZ9jGncQers1OvOEkHOB3xn3EJ3ZWGL60ZxQYvmfBTEWnJ+MKhwE4W?=
 =?us-ascii?Q?YaRQDoyjWd7an7LGAVuNTPf9jP+p5oc3/oaFq7ISVe9ZHt07t1Qbw7NkPN/o?=
 =?us-ascii?Q?j9+i6+Ch2U4FIMPZLJ26d6Ydh+6Dbljju1vaXlAjRqmPQ3zIuNY50FGl2QJE?=
 =?us-ascii?Q?PwAo75gOMh71WzEhiqesdguHK4CkGTLNIchku5+XZTgiSdhdelxyxYNy4tXR?=
 =?us-ascii?Q?mUCbkg=3D=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 82fdacf5-75c1-4dec-256d-08d9da7ec8c6
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Jan 2022 12:33:52.2236
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: VzT1iZnfZPewdAlIS75FhybNJDAfbz9vJ4Q2h8Zch26xBP/wgh8V7U907/u4ykXMJC/Go3U1zx8sMmvD8tegDWy3alQ/fYjRp9Vxn5m9nBg=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB4799
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10230 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 phishscore=0 bulkscore=0
 mlxlogscore=999 adultscore=0 suspectscore=0 malwarescore=0 mlxscore=0
 spamscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2201180076
X-Proofpoint-GUID: YDykSDtvQeM3iWMYB1ptXm7xzppUvVvQ
X-Proofpoint-ORIG-GUID: YDykSDtvQeM3iWMYB1ptXm7xzppUvVvQ
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Hi Jiasheng,

url:    https://github.com/0day-ci/linux/commits/Jiasheng-Jiang/lkdtm-bugs-Check-for-the-NULL-pointer-after-calling-kmalloc/20220114-162452
base:   https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git d47c7407b4c88cf66098eba8893bc38279f301fc
config: arm-randconfig-m031-20220113 (https://download.01.org/0day-ci/archive/20220115/202201150641.NvpCoUdU-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 11.2.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
drivers/misc/lkdtm/bugs.c:331 lkdtm_ARRAY_BOUNDS() warn: possible memory leak of 'checked'
drivers/misc/lkdtm/bugs.c:331 lkdtm_ARRAY_BOUNDS() warn: possible memory leak of 'not_checked'

Old smatch warnings:
drivers/misc/lkdtm/bugs.c:346 lkdtm_ARRAY_BOUNDS() error: buffer overflow 'checked->data' 8 <= 8

vim +/checked +331 drivers/misc/lkdtm/bugs.c

ae2e1aad3e48e4 Kees Cook      2020-04-06  322  void lkdtm_ARRAY_BOUNDS(void)
ae2e1aad3e48e4 Kees Cook      2020-04-06  323  {
ae2e1aad3e48e4 Kees Cook      2020-04-06  324  	struct array_bounds_flex_array *not_checked;
ae2e1aad3e48e4 Kees Cook      2020-04-06  325  	struct array_bounds *checked;
ae2e1aad3e48e4 Kees Cook      2020-04-06  326  	volatile int i;
ae2e1aad3e48e4 Kees Cook      2020-04-06  327  
ae2e1aad3e48e4 Kees Cook      2020-04-06  328  	not_checked = kmalloc(sizeof(*not_checked) * 2, GFP_KERNEL);
ae2e1aad3e48e4 Kees Cook      2020-04-06  329  	checked = kmalloc(sizeof(*checked) * 2, GFP_KERNEL);
6ac33daa73b3fe Jiasheng Jiang 2022-01-14  330  	if (!not_checked || !checked)
6ac33daa73b3fe Jiasheng Jiang 2022-01-14 @331  		return;

We've just changed one static checker warning for another.  Plus these
functions are *supposed* to be buggy.

ae2e1aad3e48e4 Kees Cook      2020-04-06  332  
ae2e1aad3e48e4 Kees Cook      2020-04-06  333  	pr_info("Array access within bounds ...\n");
ae2e1aad3e48e4 Kees Cook      2020-04-06  334  	/* For both, touch all bytes in the actual member size. */
ae2e1aad3e48e4 Kees Cook      2020-04-06  335  	for (i = 0; i < sizeof(checked->data); i++)
ae2e1aad3e48e4 Kees Cook      2020-04-06  336  		checked->data[i] = 'A';
ae2e1aad3e48e4 Kees Cook      2020-04-06  337  	/*
ae2e1aad3e48e4 Kees Cook      2020-04-06  338  	 * For the uninstrumented flex array member, also touch 1 byte
ae2e1aad3e48e4 Kees Cook      2020-04-06  339  	 * beyond to verify it is correctly uninstrumented.
ae2e1aad3e48e4 Kees Cook      2020-04-06  340  	 */
ae2e1aad3e48e4 Kees Cook      2020-04-06  341  	for (i = 0; i < sizeof(not_checked->data) + 1; i++)
ae2e1aad3e48e4 Kees Cook      2020-04-06  342  		not_checked->data[i] = 'A';
ae2e1aad3e48e4 Kees Cook      2020-04-06  343  
ae2e1aad3e48e4 Kees Cook      2020-04-06  344  	pr_info("Array access beyond bounds ...\n");
ae2e1aad3e48e4 Kees Cook      2020-04-06  345  	for (i = 0; i < sizeof(checked->data) + 1; i++)
ae2e1aad3e48e4 Kees Cook      2020-04-06  346  		checked->data[i] = 'B';
ae2e1aad3e48e4 Kees Cook      2020-04-06  347  
ae2e1aad3e48e4 Kees Cook      2020-04-06  348  	kfree(not_checked);
ae2e1aad3e48e4 Kees Cook      2020-04-06  349  	kfree(checked);
464e86b4abadfc Kees Cook      2020-06-25  350  	pr_err("FAIL: survived array bounds overflow!\n");
c75be56e35b2ee Kees Cook      2021-08-18  351  	pr_expected_config(CONFIG_UBSAN_BOUNDS);
ae2e1aad3e48e4 Kees Cook      2020-04-06  352  }

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org