Received-SPF: pass (google.com: domain of linux-kernel+bounces-19393-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates
 216.228.117.160 as permitted sender) receiver=protection.outlook.com;
 client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C
References: <20231229065241.554726-1-huangjunxian6@hisilicon.com>
 <20231229065241.554726-3-huangjunxian6@hisilicon.com>
 <fb7c85a4-165d-7eda-740a-d11a32cb86c0@hisilicon.com>
User-agent: mu4e 1.8.11; emacs 28.3
From: Petr Machata <petrm@nvidia.com>
To: Junxian Huang <huangjunxian6@hisilicon.com>
CC: <jgg@ziepe.ca>, <leon@kernel.org>, <dsahern@gmail.com>,
	<stephen@networkplumber.org>, Chengchang Tang <tangchengchang@huawei.com>,
	<netdev@vger.kernel.org>, <linux-rdma@vger.kernel.org>,
	<linuxarm@huawei.com>, <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH iproute2-rc 2/2] rdma: Fix the error of accessing string
 variable outside the lifecycle
Date: Mon, 8 Jan 2024 12:09:04 +0100
In-Reply-To: <fb7c85a4-165d-7eda-740a-d11a32cb86c0@hisilicon.com>
Message-ID: <8734v8ozcn.fsf@nvidia.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jan 2024 11:10:19.1699
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 402252f7-66c9-4ea6-4c2b-08dc103a6682
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com]
X-MS-Exchange-CrossTenant-AuthSource:
	SA2PEPF000015CB.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR12MB9143


Junxian Huang <huangjunxian6@hisilicon.com> writes:

> the first patch is replaced by Stephen's latest patches. Are there any
> comments to this patch?

Yeah, what the code is currently doing is invalid.

Reviewed-by: Petr Machata <petrm@nvidia.com>

> Thanks,
> Junxian
>
> On 2023/12/29 14:52, Junxian Huang wrote:
>> From: wenglianfa <wenglianfa@huawei.com>
>> 
>> All these SPRINT_BUF(b) definitions are inside the 'if' block, but
>> accessed outside the 'if' block through the pointers 'comm'. This
>> leads to empty 'comm' attribute when querying resource information.
>> So move the definitions to the beginning of the functions to extend
>> their life cycle.
>> 
>> Before:
>> $ rdma res show srq
>> dev hns_0 srqn 0 type BASIC lqpn 18 pdn 5 pid 7775 comm
>> 
>> After:
>> $ rdma res show srq
>> dev hns_0 srqn 0 type BASIC lqpn 18 pdn 5 pid 7775 comm ib_send_bw
>> 
>> Fixes: 1808f002dfdd ("lib/fs: fix memory leak in get_task_name()")
>> Signed-off-by: wenglianfa <wenglianfa@huawei.com>
>> Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
>> ---
>>  rdma/res-cmid.c | 3 +--
>>  rdma/res-cq.c   | 3 +--
>>  rdma/res-ctx.c  | 3 +--
>>  rdma/res-mr.c   | 3 +--
>>  rdma/res-pd.c   | 3 +--
>>  rdma/res-qp.c   | 3 +--
>>  rdma/res-srq.c  | 3 +--
>>  rdma/stat.c     | 3 +--
>>  8 files changed, 8 insertions(+), 16 deletions(-)
>> 
>> diff --git a/rdma/res-cmid.c b/rdma/res-cmid.c
>> index 7371c3a6..595af848 100644
>> --- a/rdma/res-cmid.c
>> +++ b/rdma/res-cmid.c
>> @@ -102,6 +102,7 @@ static int res_cm_id_line(struct rd *rd, const char *name, int idx,
>>  	uint32_t lqpn = 0, ps;
>>  	uint32_t cm_idn = 0;
>>  	char *comm = NULL;
>> +	SPRINT_BUF(b);
>>  
>>  	if (!nla_line[RDMA_NLDEV_ATTR_RES_STATE] ||
>>  	    !nla_line[RDMA_NLDEV_ATTR_RES_PS])
>> @@ -159,8 +160,6 @@ static int res_cm_id_line(struct rd *rd, const char *name, int idx,
>>  		goto out;
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;
>> diff --git a/rdma/res-cq.c b/rdma/res-cq.c
>> index 2cfa4994..80994a03 100644
>> --- a/rdma/res-cq.c
>> +++ b/rdma/res-cq.c
>> @@ -63,6 +63,7 @@ static int res_cq_line(struct rd *rd, const char *name, int idx,
>>  	uint32_t cqn = 0;
>>  	uint64_t users;
>>  	uint32_t cqe;
>> +	SPRINT_BUF(b);
>>  
>>  	if (!nla_line[RDMA_NLDEV_ATTR_RES_CQE] ||
>>  	    !nla_line[RDMA_NLDEV_ATTR_RES_USECNT])
>> @@ -84,8 +85,6 @@ static int res_cq_line(struct rd *rd, const char *name, int idx,
>>  		goto out;
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;
>> diff --git a/rdma/res-ctx.c b/rdma/res-ctx.c
>> index 500186d9..99736ea0 100644
>> --- a/rdma/res-ctx.c
>> +++ b/rdma/res-ctx.c
>> @@ -13,13 +13,12 @@ static int res_ctx_line(struct rd *rd, const char *name, int idx,
>>  	char *comm = NULL;
>>  	uint32_t ctxn = 0;
>>  	uint32_t pid = 0;
>> +	SPRINT_BUF(b);
>>  
>>  	if (!nla_line[RDMA_NLDEV_ATTR_RES_CTXN])
>>  		return MNL_CB_ERROR;
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;
>> diff --git a/rdma/res-mr.c b/rdma/res-mr.c
>> index fb48d5df..e6c81d11 100644
>> --- a/rdma/res-mr.c
>> +++ b/rdma/res-mr.c
>> @@ -30,6 +30,7 @@ static int res_mr_line(struct rd *rd, const char *name, int idx,
>>  	uint32_t pdn = 0;
>>  	uint32_t mrn = 0;
>>  	uint32_t pid = 0;
>> +	SPRINT_BUF(b);
>>  
>>  	if (!nla_line[RDMA_NLDEV_ATTR_RES_MRLEN])
>>  		return MNL_CB_ERROR;
>> @@ -47,8 +48,6 @@ static int res_mr_line(struct rd *rd, const char *name, int idx,
>>  		goto out;
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;
>> diff --git a/rdma/res-pd.c b/rdma/res-pd.c
>> index 66f91f42..0dbb310a 100644
>> --- a/rdma/res-pd.c
>> +++ b/rdma/res-pd.c
>> @@ -16,6 +16,7 @@ static int res_pd_line(struct rd *rd, const char *name, int idx,
>>  	uint32_t pid = 0;
>>  	uint32_t pdn = 0;
>>  	uint64_t users;
>> +	SPRINT_BUF(b);
>>  
>>  	if (!nla_line[RDMA_NLDEV_ATTR_RES_USECNT])
>>  		return MNL_CB_ERROR;
>> @@ -34,8 +35,6 @@ static int res_pd_line(struct rd *rd, const char *name, int idx,
>>  			nla_line[RDMA_NLDEV_ATTR_RES_UNSAFE_GLOBAL_RKEY]);
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;
>> diff --git a/rdma/res-qp.c b/rdma/res-qp.c
>> index c180a97e..cd2f4aa2 100644
>> --- a/rdma/res-qp.c
>> +++ b/rdma/res-qp.c
>> @@ -86,6 +86,7 @@ static int res_qp_line(struct rd *rd, const char *name, int idx,
>>  	uint32_t port = 0, pid = 0;
>>  	uint32_t pdn = 0;
>>  	char *comm = NULL;
>> +	SPRINT_BUF(b);
>>  
>>  	if (!nla_line[RDMA_NLDEV_ATTR_RES_LQPN] ||
>>  	    !nla_line[RDMA_NLDEV_ATTR_RES_SQ_PSN] ||
>> @@ -146,8 +147,6 @@ static int res_qp_line(struct rd *rd, const char *name, int idx,
>>  		goto out;
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;
>> diff --git a/rdma/res-srq.c b/rdma/res-srq.c
>> index cf9209d7..758bb193 100644
>> --- a/rdma/res-srq.c
>> +++ b/rdma/res-srq.c
>> @@ -183,13 +183,12 @@ static int res_srq_line(struct rd *rd, const char *name, int idx,
>>  	char qp_str[MAX_QP_STR_LEN] = {};
>>  	char *comm = NULL;
>>  	uint8_t type = 0;
>> +	SPRINT_BUF(b);
>>  
>>  	if (!nla_line[RDMA_NLDEV_ATTR_RES_SRQN])
>>  		return MNL_CB_ERROR;
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;
>> diff --git a/rdma/stat.c b/rdma/stat.c
>> index 3df2c98f..c7dde680 100644
>> --- a/rdma/stat.c
>> +++ b/rdma/stat.c
>> @@ -223,6 +223,7 @@ static int res_counter_line(struct rd *rd, const char *name, int index,
>>  	struct nlattr *hwc_table, *qp_table;
>>  	struct nlattr *nla_entry;
>>  	const char *comm = NULL;
>> +	SPRINT_BUF(b);
>>  	bool isfirst;
>>  	int err;
>>  
>> @@ -248,8 +249,6 @@ static int res_counter_line(struct rd *rd, const char *name, int index,
>>  		return MNL_CB_OK;
>>  
>>  	if (nla_line[RDMA_NLDEV_ATTR_RES_PID]) {
>> -		SPRINT_BUF(b);
>> -
>>  		pid = mnl_attr_get_u32(nla_line[RDMA_NLDEV_ATTR_RES_PID]);
>>  		if (!get_task_name(pid, b, sizeof(b)))
>>  			comm = b;