From: Eric Garver <e@erig.me>
To: Arnd Bergmann <arnd@arndb.de>
Cc: Jiri Pirko <jiri@resnulli.us>,
"David S. Miller" <davem@davemloft.net>,
Alexander Duyck <aduyck@mirantis.com>,
Tom Herbert <tom@herbertland.com>, Jiri Pirko <jiri@mellanox.com>,
Hadar Hen Zion <hadarh@mellanox.com>,
Gao Feng <fgao@48lvckh6395k16k5.yundunddos.com>,
Amir Vadai <amir@vadai.me>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] flow_dissector: avoid uninitialized variable access
Date: Sat, 22 Oct 2016 11:57:52 -0400 [thread overview]
Message-ID: <20161022155752.GD26044@egarver> (raw)
In-Reply-To: <3516805.IZ705sLgKU@wuerfel>
On Sat, Oct 22, 2016 at 12:16:29AM +0200, Arnd Bergmann wrote:
> On Friday, October 21, 2016 11:05:45 PM CEST Arnd Bergmann wrote:
> >
> > Can you explain why "dissector_uses_key(flow_dissector,
> > FLOW_DISSECTOR_KEY_VLAN) && skb_vlan_tag_present(skb)" implies
> > "eth_type_vlan(proto))"?
> >
> > If I add uninitialized_var() here, I would at least put that in
> > a comment here.
>
> Found it now myself: if skb_vlan_tag_present(skb), then we don't
> access 'vlan', otherwise we know it is initialized because
> eth_type_vlan(proto) has to be true.
>
> > On a related note, I also don't see how
> > "dissector_uses_key(flow_dissector, FLOW_DISSECTOR_KEY_VLAN)"
> > implies that skb is non-NULL. I guess this is related to the
> > first one.
>
> I'm still unsure about this one.
Only skb_flow_dissect_flow_keys_buf() calls this function with skb ==
NULL. It uses flow_keys_buf_dissector_keys which does not specify
FLOW_DISSECTOR_KEY_VLAN, so the if statement is false.
A similar assumption is made for FLOW_DISSECTOR_KEY_ETH_ADDRS higher up.
> I also found something else that is suspicious: 'vlan' points
> to the local _vlan variable, but that has gone out of scope
> by the time we access the pointer, which doesn't seem safe.
I see no harm in moving _vlan to the same scope as vlan.
next prev parent reply other threads:[~2016-10-22 15:58 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-21 15:55 [PATCH] flow_dissector: avoid uninitialized variable access Arnd Bergmann
2016-10-21 15:55 ` Arnd Bergmann
2016-10-21 16:31 ` Jiri Pirko
2016-10-21 16:31 ` Jiri Pirko
2016-10-21 21:05 ` Arnd Bergmann
2016-10-21 21:05 ` Arnd Bergmann
2016-10-21 22:16 ` Arnd Bergmann
2016-10-21 22:16 ` Arnd Bergmann
2016-10-22 15:57 ` Eric Garver [this message]
2016-10-22 18:20 ` Tom Herbert
2016-10-22 20:30 ` [PATCH net-next] flow_dissector: fix vlan tag handling Arnd Bergmann
2016-10-24 8:17 ` Jiri Pirko
2016-10-24 16:00 ` Arnd Bergmann
2016-10-22 1:48 ` [PATCH] flow_dissector: avoid uninitialized variable access Linus Torvalds
2016-10-22 1:48 ` Linus Torvalds
2016-10-22 6:55 ` Jiri Pirko
2016-10-22 6:55 ` Jiri Pirko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161022155752.GD26044@egarver \
--to=e@erig.me \
--cc=aduyck@mirantis.com \
--cc=amir@vadai.me \
--cc=arnd@arndb.de \
--cc=davem@davemloft.net \
--cc=fgao@48lvckh6395k16k5.yundunddos.com \
--cc=hadarh@mellanox.com \
--cc=jiri@mellanox.com \
--cc=jiri@resnulli.us \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=tom@herbertland.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.