Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33;
Message-ID: <8fec7a59-5fc0-a543-8b87-f4b2a9232aa9@opensource.cirrus.com>
Date:   Thu, 28 Sep 2023 10:32:36 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: [PATCH] kunit: debugfs: Handle errors from alloc_string_stream()
To:     <brendan.higgins@linux.dev>, <davidgow@google.com>
CC:     <linux-kselftest@vger.kernel.org>, <kunit-dev@googlegroups.com>,
        <linux-kernel@vger.kernel.org>,
        Dan Carpenter <dan.carpenter@linaro.org>
References: <20230927165058.29484-1-rf@opensource.cirrus.com>
Content-Language: en-US
From:   Richard Fitzgerald <rf@opensource.cirrus.com>
In-Reply-To: <20230927165058.29484-1-rf@opensource.cirrus.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 27/09/2023 17:50, Richard Fitzgerald wrote:
> In kunit_debugfs_create_suite() give up and skip creating the debugfs
> file if any of the alloc_string_stream() calls return an error or NULL.
> Only put a value in the log pointer of kunit_suite and kunit_test if it
> is a valid pointer to a log.
> 
> This prevents the potential invalid dereference reported by smatch:
> 
>   lib/kunit/debugfs.c:115 kunit_debugfs_create_suite() error: 'suite->log'
> 	dereferencing possible ERR_PTR()
>   lib/kunit/debugfs.c:119 kunit_debugfs_create_suite() error: 'test_case->log'
> 	dereferencing possible ERR_PTR()
> 
> Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Fixes: 05e2006ce493 ("kunit: Use string_stream for test log")
> ---
>   lib/kunit/debugfs.c | 29 ++++++++++++++++++++++++-----
>   1 file changed, 24 insertions(+), 5 deletions(-)
> 
> diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c
> index 270d185737e6..73075ca6e88c 100644
> --- a/lib/kunit/debugfs.c
> +++ b/lib/kunit/debugfs.c
> @@ -109,14 +109,27 @@ static const struct file_operations debugfs_results_fops = {
>   void kunit_debugfs_create_suite(struct kunit_suite *suite)
>   {
>   	struct kunit_case *test_case;
> +	struct string_stream *stream;
>   
> -	/* Allocate logs before creating debugfs representation. */
> -	suite->log = alloc_string_stream(GFP_KERNEL);
> -	string_stream_set_append_newlines(suite->log, true);
> +	/*
> +	 * Allocate logs before creating debugfs representation.
> +	 * The log pointer must be NULL if there isn't a log so only
> +	 * set it if the log stream was created successfully.
> +	 */
> +	stream = alloc_string_stream(GFP_KERNEL);
> +	if (IS_ERR_OR_NULL(stream))
> +		goto err;

This can be a return. Nothing has been created at this point so
there is nothing to clean up.
I'll send a V2.

> +
> +	string_stream_set_append_newlines(stream, true);
> +	suite->log = stream;
>   
>   	kunit_suite_for_each_test_case(suite, test_case) {
> -		test_case->log = alloc_string_stream(GFP_KERNEL);
> -		string_stream_set_append_newlines(test_case->log, true);
> +		stream = alloc_string_stream(GFP_KERNEL);
> +		if (IS_ERR_OR_NULL(stream))
> +			goto err;
> +
> +		string_stream_set_append_newlines(stream, true);
> +		test_case->log = stream;
>   	}
>   
>   	suite->debugfs = debugfs_create_dir(suite->name, debugfs_rootdir);
> @@ -124,6 +137,12 @@ void kunit_debugfs_create_suite(struct kunit_suite *suite)
>   	debugfs_create_file(KUNIT_DEBUGFS_RESULTS, S_IFREG | 0444,
>   			    suite->debugfs,
>   			    suite, &debugfs_results_fops);
> +	return;
> +
> +err:
> +	string_stream_destroy(suite->log);
> +	kunit_suite_for_each_test_case(suite, test_case)
> +		string_stream_destroy(test_case->log);
>   }
>   
>   void kunit_debugfs_destroy_suite(struct kunit_suite *suite)