Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Siddh Raman Pant <code@siddh.me>
To:     palmer@rivosinc.com
Cc:     davem@davemloft.net, edumazet@google.com, johan.hedberg@gmail.com,
        kuba@kernel.org, linux-bluetooth@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux@rivosinc.com,
        luiz.dentz@gmail.com, marcel@holtmann.org, netdev@vger.kernel.org,
        pabeni@redhat.com
Message-ID: <20220825110108.157350-1-code@siddh.me>
Subject: Re: [PATCH] Bluetooth: L2CAP: Elide a string overflow warning
Date:   Thu, 25 Aug 2022 16:31:08 +0530
In-Reply-To: <20220812055249.8037-1-palmer@rivosinc.com>
References: <20220812055249.8037-1-palmer@rivosinc.com>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset=utf8
Precedence: bulk

On Fri, 12 Aug 2022 11:22:49 +0530  Palmer Dabbelt  wrote:
> From: Palmer Dabbelt <palmer@rivosinc.com>
>=20
> Without this I get a string op warning related to copying from a
> possibly NULL pointer.  I think the warning is spurious, but it's
> tripping up allmodconfig.

I think it is not spurious, and is due to the following commit:
d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_pu=
t")

The following commit fixes a similar problem (added the NULL check on line =
1996):
332f1795ca20 ("Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression")

> In file included from /scratch/merges/ko-linux-next/linux/include/linux/s=
tring.h:253,
>                  from /scratch/merges/ko-linux-next/linux/include/linux/b=
itmap.h:11,
>                  from /scratch/merges/ko-linux-next/linux/include/linux/c=
pumask.h:12,
>                  from /scratch/merges/ko-linux-next/linux/include/linux/m=
m_types_task.h:14,
>                  from /scratch/merges/ko-linux-next/linux/include/linux/m=
m_types.h:5,
>                  from /scratch/merges/ko-linux-next/linux/include/linux/b=
uildid.h:5,
>                  from /scratch/merges/ko-linux-next/linux/include/linux/m=
odule.h:14,
>                  from /scratch/merges/ko-linux-next/linux/net/bluetooth/l=
2cap_core.c:31:
> In function 'memcmp',
>     inlined from 'bacmp' at /scratch/merges/ko-linux-next/linux/include/n=
et/bluetooth/bluetooth.h:347:9,
>     inlined from 'l2cap_global_chan_by_psm' at /scratch/merges/ko-linux-n=
ext/linux/net/bluetooth/l2cap_core.c:2003:15:
> /scratch/merges/ko-linux-next/linux/include/linux/fortify-string.h:44:33:=
 error: '__builtin_memcmp' specified bound 6 exceeds source size 0 [-Werror=
=3Dstringop-overread]
>    44 | #define __underlying_memcmp     __builtin_memcmp
>       |                                 ^
> /scratch/merges/ko-linux-next/linux/include/linux/fortify-string.h:420:16=
: note: in expansion of macro '__underlying_memcmp'
>   420 |         return __underlying_memcmp(p, q, size);
>       |                ^~~~~~~~~~~~~~~~~~~
> In function 'memcmp',
>     inlined from 'bacmp' at /scratch/merges/ko-linux-next/linux/include/n=
et/bluetooth/bluetooth.h:347:9,
>     inlined from 'l2cap_global_chan_by_psm' at /scratch/merges/ko-linux-n=
ext/linux/net/bluetooth/l2cap_core.c:2004:15:
> /scratch/merges/ko-linux-next/linux/include/linux/fortify-string.h:44:33:=
 error: '__builtin_memcmp' specified bound 6 exceeds source size 0 [-Werror=
=3Dstringop-overread]
>    44 | #define __underlying_memcmp     __builtin_memcmp
>       |                                 ^
> /scratch/merges/ko-linux-next/linux/include/linux/fortify-string.h:420:16=
: note: in expansion of macro '__underlying_memcmp'
>   420 |         return __underlying_memcmp(p, q, size);
>       |                ^~~~~~~~~~~~~~~~~~~
> cc1: all warnings being treated as errors
>=20
> Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>

Tested-by: Siddh Raman Pant <code@siddh.me>

> ---
>  net/bluetooth/l2cap_core.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
>=20
> diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
> index cbe0cae73434..be7f47e52119 100644
> --- a/net/bluetooth/l2cap_core.c
> +++ b/net/bluetooth/l2cap_core.c
> @@ -2000,11 +2000,13 @@ static struct l2cap_chan *l2cap_global_chan_by_ps=
m(int state, __le16 psm,
>  =09=09=09}
> =20
>  =09=09=09/* Closest match */
> -=09=09=09src_any =3D !bacmp(&c->src, BDADDR_ANY);
> -=09=09=09dst_any =3D !bacmp(&c->dst, BDADDR_ANY);
> -=09=09=09if ((src_match && dst_any) || (src_any && dst_match) ||
> -=09=09=09    (src_any && dst_any))
> -=09=09=09=09c1 =3D c;
> +=09=09=09if (c) {
> +=09=09=09=09src_any =3D !bacmp(&c->src, BDADDR_ANY);
> +=09=09=09=09dst_any =3D !bacmp(&c->dst, BDADDR_ANY);
> +=09=09=09=09if ((src_match && dst_any) || (src_any && dst_match) ||
> +=09=09=09=09    (src_any && dst_any))
> +=09=09=09=09=09c1 =3D c;
> +=09=09=09}
>  =09=09}
>  =09}
> =20