Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates
 216.228.117.161 as permitted sender) receiver=protection.outlook.com;
 client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C
References: <20230116144853.2446315-1-daniel.machon@microchip.com>
 <20230116144853.2446315-4-daniel.machon@microchip.com>
 <87lem0w1k3.fsf@nvidia.com> <Y8gLRF7/0sttKkPx@kadam>
User-agent: mu4e 1.6.6; emacs 28.1
From:   Petr Machata <petrm@nvidia.com>
To:     Dan Carpenter <error27@gmail.com>
CC:     Petr Machata <petrm@nvidia.com>,
        Daniel Machon <daniel.machon@microchip.com>,
        <netdev@vger.kernel.org>, <davem@davemloft.net>,
        <edumazet@google.com>, <kuba@kernel.org>, <pabeni@redhat.com>,
        <lars.povlsen@microchip.com>, <Steen.Hegelund@microchip.com>,
        <UNGLinuxDriver@microchip.com>, <joe@perches.com>,
        <horatiu.vultur@microchip.com>, <Julia.Lawall@inria.fr>,
        <vladimir.oltean@nxp.com>, <maxime.chevallier@bootlin.com>,
        <linux-arm-kernel@lists.infradead.org>,
        <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH net-next v2 3/6] net: dcb: add new rewrite table
Date:   Thu, 19 Jan 2023 10:38:03 +0100
In-Reply-To: <Y8gLRF7/0sttKkPx@kadam>
Message-ID: <87wn5i7soz.fsf@nvidia.com>
MIME-Version: 1.0
Content-Type: text/plain
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jan 2023 09:57:32.4967
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 64ba73dd-460c-47fa-d066-08dafa03957f
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.161];Helo=[mail.nvidia.com]
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT070.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA1PR12MB6043
X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        SPF_HELO_PASS,SPF_NONE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org


Dan Carpenter <error27@gmail.com> writes:

> On Wed, Jan 18, 2023 at 11:54:23AM +0100, Petr Machata wrote:
>> > +
>> > +	spin_lock_bh(&dcb_lock);
>> > +	list_for_each_entry(itr, &dcb_rewr_list, list) {
>> > +		if (itr->ifindex == netdev->ifindex) {
>> > +			enum ieee_attrs_app type =
>> > +				dcbnl_app_attr_type_get(itr->app.selector);
>> > +			err = nla_put(skb, type, sizeof(itr->app), &itr->app);
>> > +			if (err) {
>> > +				spin_unlock_bh(&dcb_lock);
>> 
>> This should cancel the nest started above.
>> 
>
> If you see a bug like this, you may as well ask Julia or me to add a
> static checker warning for it.  We're both already on the CC list but we
> might not be following the conversation closely...

I'll try to remember next time.

> In Smatch, I thought it would be easy but it turned out I need to add
> a hack around to change the second nla_nest_start_noflag() from unknown
> to valid pointer.
>
> diff --git a/check_unwind.c b/check_unwind.c
> index a397afd2346b..3128476cbeb6 100644
> --- a/check_unwind.c
> +++ b/check_unwind.c
> @@ -94,6 +94,11 @@ static struct ref_func_info func_table[] = {
>  
>  	{ "ieee80211_alloc_hw", ALLOC,  -1, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
>  	{ "ieee80211_free_hw",  RELEASE, 0, "$" },
> +
> +	{ "nla_nest_start_noflag", ALLOC, 0, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
> +	{ "nla_nest_start", ALLOC, 0, "$", &valid_ptr_min_sval, &valid_ptr_max_sval },
> +	{ "nla_nest_end", RELEASE, 0, "$" },
> +	{ "nla_nest_cancel", RELEASE, 0, "$" },
>  };
>  
>  static struct smatch_state *unmatched_state(struct sm_state *sm)
> diff --git a/smatch_data/db/kernel.return_fixes b/smatch_data/db/kernel.return_fixes
> index fa4ed4ba5f0f..4782c5e10cdb 100644
> --- a/smatch_data/db/kernel.return_fixes
> +++ b/smatch_data/db/kernel.return_fixes
> @@ -90,3 +90,4 @@ dma_resv_wait_timeout s64min-(-1),1-s64max 1-s64max[<=$3]
>  mmc_io_rw_direct_host s32min-(-1),1-s32max (-4095)-(-1)
>  ad3552r_transfer s32min-(-1),1-s32max (-4095)-(-1)
>  adin1110_read_reg s32min-(-1),1-s32max (-4095)-(-1)
> +nla_nest_start_noflag 0-u64max 4096-ptr_max
>
> Unfortunately, there is something weird going on and only my unreleased
> version of Smatch finds the bug:
>
> net/dcb/dcbnl.c:1306 dcbnl_ieee_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1160,1171,1184,1197,1207,1217,1222,1232,1257.
> net/dcb/dcbnl.c:1502 dcbnl_cee_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1502.

Looking at a couple of those, yeah, it looks legit. Those are missing
the cancel on error returns.

> I have been working on that check recently...  Both the released and
> unreleased versions of Smatch have the following complaints:
>
> net/dcb/dcbnl.c:400 dcbnl_getnumtcs() warn: 'skb' from nla_nest_start_noflag() not released on lines: 396.
> net/dcb/dcbnl.c:1061 dcbnl_build_peer_app() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1061.
> net/dcb/dcbnl.c:1359 dcbnl_cee_pg_fill() warn: 'skb' from nla_nest_start_noflag() not released on lines: 1324,1342.

Likewise. Strange that each version reports a different subset. Or is
that just selective quoting?