From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: security/apparmor/label.c:1886 aa_label_strn_parse() warn: potentially one past the end of array 'vec[i]'
Date: Thu, 18 Dec 2025 01:43:38 +0800 [thread overview]
Message-ID: <202512180126.G85lF99L-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Suren Baghdasaryan <surenb@google.com>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: ea1013c1539270e372fc99854bc6e4d94eaeff66
commit: 07438779313caafe52ac1a1a6958d735a5938988 alloc_tag: avoid current->alloc_tag manipulations when profiling is disabled
date: 11 months ago
:::::: branch date: 14 hours ago
:::::: commit date: 11 months ago
config: x86_64-randconfig-161-20251213 (https://download.01.org/0day-ci/archive/20251218/202512180126.G85lF99L-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202512180126.G85lF99L-lkp@intel.com/
smatch warnings:
security/apparmor/label.c:1886 aa_label_strn_parse() warn: potentially one past the end of array 'vec[i]'
security/apparmor/label.c:1886 aa_label_strn_parse() warn: potentially one past the end of array 'vec[i]'
vim +1886 security/apparmor/label.c
f1bd904175e819 John Johansen 2017-06-09 1841
f1bd904175e819 John Johansen 2017-06-09 1842 /**
95652cac83605d John Johansen 2017-09-06 1843 * aa_label_strn_parse - parse, validate and convert a text string to a label
f1bd904175e819 John Johansen 2017-06-09 1844 * @base: base label to use for lookups (NOT NULL)
f1bd904175e819 John Johansen 2017-06-09 1845 * @str: null terminated text string (NOT NULL)
95652cac83605d John Johansen 2017-09-06 1846 * @n: length of str to parse, will stop at \0 if encountered before n
f1bd904175e819 John Johansen 2017-06-09 1847 * @gfp: allocation type
f1bd904175e819 John Johansen 2017-06-09 1848 * @create: true if should create compound labels if they don't exist
f1bd904175e819 John Johansen 2017-06-09 1849 * @force_stack: true if should stack even if no leading &
f1bd904175e819 John Johansen 2017-06-09 1850 *
f1bd904175e819 John Johansen 2017-06-09 1851 * Returns: the matching refcounted label if present
f1bd904175e819 John Johansen 2017-06-09 1852 * else ERRPTR
f1bd904175e819 John Johansen 2017-06-09 1853 */
95652cac83605d John Johansen 2017-09-06 1854 struct aa_label *aa_label_strn_parse(struct aa_label *base, const char *str,
95652cac83605d John Johansen 2017-09-06 1855 size_t n, gfp_t gfp, bool create,
95652cac83605d John Johansen 2017-09-06 1856 bool force_stack)
f1bd904175e819 John Johansen 2017-06-09 1857 {
f1bd904175e819 John Johansen 2017-06-09 1858 DEFINE_VEC(profile, vec);
f1bd904175e819 John Johansen 2017-06-09 1859 struct aa_label *label, *currbase = base;
f1bd904175e819 John Johansen 2017-06-09 1860 int i, len, stack = 0, error;
95652cac83605d John Johansen 2017-09-06 1861 const char *end = str + n;
6e0654d20ed967 John Johansen 2017-09-06 1862 const char *split;
f1bd904175e819 John Johansen 2017-06-09 1863
f1bd904175e819 John Johansen 2017-06-09 1864 AA_BUG(!base);
f1bd904175e819 John Johansen 2017-06-09 1865 AA_BUG(!str);
f1bd904175e819 John Johansen 2017-06-09 1866
95652cac83605d John Johansen 2017-09-06 1867 str = skipn_spaces(str, n);
511f7b5b835726 John Johansen 2021-12-14 1868 if (str == NULL || (AA_DEBUG_LABEL && *str == '_' &&
511f7b5b835726 John Johansen 2021-12-14 1869 base != &root_ns->unconfined->label))
95652cac83605d John Johansen 2017-09-06 1870 return ERR_PTR(-EINVAL);
475bdda1f00074 John Johansen 2017-09-08 1871
95652cac83605d John Johansen 2017-09-06 1872 len = label_count_strn_entries(str, end - str);
f1bd904175e819 John Johansen 2017-06-09 1873 if (*str == '&' || force_stack) {
f1bd904175e819 John Johansen 2017-06-09 1874 /* stack on top of base */
f1bd904175e819 John Johansen 2017-06-09 1875 stack = base->size;
f1bd904175e819 John Johansen 2017-06-09 1876 len += stack;
f1bd904175e819 John Johansen 2017-06-09 1877 if (*str == '&')
f1bd904175e819 John Johansen 2017-06-09 1878 str++;
f1bd904175e819 John Johansen 2017-06-09 1879 }
26b7899510ae24 John Johansen 2017-08-06 1880
f1bd904175e819 John Johansen 2017-06-09 1881 error = vec_setup(profile, vec, len, gfp);
f1bd904175e819 John Johansen 2017-06-09 1882 if (error)
f1bd904175e819 John Johansen 2017-06-09 1883 return ERR_PTR(error);
f1bd904175e819 John Johansen 2017-06-09 1884
f1bd904175e819 John Johansen 2017-06-09 1885 for (i = 0; i < stack; i++)
f1bd904175e819 John Johansen 2017-06-09 @1886 vec[i] = aa_get_profile(base->vec[i]);
f1bd904175e819 John Johansen 2017-06-09 1887
95652cac83605d John Johansen 2017-09-06 1888 for (split = aa_label_strn_split(str, end - str), i = stack;
6e0654d20ed967 John Johansen 2017-09-06 1889 split && i < len; i++) {
f1bd904175e819 John Johansen 2017-06-09 1890 vec[i] = fqlookupn_profile(base, currbase, str, split - str);
f1bd904175e819 John Johansen 2017-06-09 1891 if (!vec[i])
f1bd904175e819 John Johansen 2017-06-09 1892 goto fail;
f1bd904175e819 John Johansen 2017-06-09 1893 /*
f1bd904175e819 John Johansen 2017-06-09 1894 * if component specified a new ns it becomes the new base
f1bd904175e819 John Johansen 2017-06-09 1895 * so that subsequent lookups are relative to it
f1bd904175e819 John Johansen 2017-06-09 1896 */
f1bd904175e819 John Johansen 2017-06-09 1897 if (vec[i]->ns != labels_ns(currbase))
f1bd904175e819 John Johansen 2017-06-09 1898 currbase = &vec[i]->label;
f1bd904175e819 John Johansen 2017-06-09 1899 str = split + 3;
95652cac83605d John Johansen 2017-09-06 1900 split = aa_label_strn_split(str, end - str);
f1bd904175e819 John Johansen 2017-06-09 1901 }
f1bd904175e819 John Johansen 2017-06-09 1902 /* last element doesn't have a split */
f1bd904175e819 John Johansen 2017-06-09 1903 if (i < len) {
95652cac83605d John Johansen 2017-09-06 1904 vec[i] = fqlookupn_profile(base, currbase, str, end - str);
f1bd904175e819 John Johansen 2017-06-09 1905 if (!vec[i])
f1bd904175e819 John Johansen 2017-06-09 1906 goto fail;
f1bd904175e819 John Johansen 2017-06-09 1907 }
f1bd904175e819 John Johansen 2017-06-09 1908 if (len == 1)
f1bd904175e819 John Johansen 2017-06-09 1909 /* no need to free vec as len < LOCAL_VEC_ENTRIES */
f1bd904175e819 John Johansen 2017-06-09 1910 return &vec[0]->label;
f1bd904175e819 John Johansen 2017-06-09 1911
f1bd904175e819 John Johansen 2017-06-09 1912 len -= aa_vec_unique(vec, len, VEC_FLAG_TERMINATE);
f1bd904175e819 John Johansen 2017-06-09 1913 /* TODO: deal with reference labels */
f1bd904175e819 John Johansen 2017-06-09 1914 if (len == 1) {
f1bd904175e819 John Johansen 2017-06-09 1915 label = aa_get_label(&vec[0]->label);
f1bd904175e819 John Johansen 2017-06-09 1916 goto out;
f1bd904175e819 John Johansen 2017-06-09 1917 }
f1bd904175e819 John Johansen 2017-06-09 1918
f1bd904175e819 John Johansen 2017-06-09 1919 if (create)
f1bd904175e819 John Johansen 2017-06-09 1920 label = aa_vec_find_or_create_label(vec, len, gfp);
f1bd904175e819 John Johansen 2017-06-09 1921 else
f1bd904175e819 John Johansen 2017-06-09 1922 label = vec_find(vec, len);
f1bd904175e819 John Johansen 2017-06-09 1923 if (!label)
f1bd904175e819 John Johansen 2017-06-09 1924 goto fail;
f1bd904175e819 John Johansen 2017-06-09 1925
f1bd904175e819 John Johansen 2017-06-09 1926 out:
f1bd904175e819 John Johansen 2017-06-09 1927 /* use adjusted len from after vec_unique, not original */
f1bd904175e819 John Johansen 2017-06-09 1928 vec_cleanup(profile, vec, len);
f1bd904175e819 John Johansen 2017-06-09 1929 return label;
f1bd904175e819 John Johansen 2017-06-09 1930
f1bd904175e819 John Johansen 2017-06-09 1931 fail:
f1bd904175e819 John Johansen 2017-06-09 1932 label = ERR_PTR(-ENOENT);
f1bd904175e819 John Johansen 2017-06-09 1933 goto out;
f1bd904175e819 John Johansen 2017-06-09 1934 }
f1bd904175e819 John Johansen 2017-06-09 1935
:::::: The code at line 1886 was first introduced by commit
:::::: f1bd904175e8190ce14aedee37e207ab51fe3b30 apparmor: add the base fns() for domain labels
:::::: TO: John Johansen <john.johansen@canonical.com>
:::::: CC: John Johansen <john.johansen@canonical.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2025-12-17 17:44 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-17 17:43 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2025-12-19 14:37 security/apparmor/label.c:1886 aa_label_strn_parse() warn: potentially one past the end of array 'vec[i]' kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202512180126.G85lF99L-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.