Re: [PATCH RFC 07/20] ctlv: Prepare schema validation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] ctlv: schema traversal ignores stub fills in reentering calculations
--

commit c53ad2ae9e8a16f911d52d764c978f30d89b6d14
Author: Jiri Pirko <jiri@resnulli.us>

ctlv: Prepare schema validation

Add generated-schema walking, message validation and request indexing.
Use the descriptor layer for blob placement checks. Keep CONFIG_CTLV unwired
until dispatch completes the module.

> diff --git a/drivers/ctlv/schema.c b/drivers/ctlv/schema.c
> new file mode 100644
> index 0000000000000..b74f9a358bc34
> --- /dev/null
> +++ b/drivers/ctlv/schema.c

[ ... ]

> +/* Size one deepest legal leaf and every nest above it. */
> +static u64 ctlv_schema_reentering_min_len(struct ctlv_schema_length_walk *walk,
> +					  const struct ctlv_schema_tree *tree)
> +{
> +	u64 leaf = 0;
> +	u32 index;
> +
> +	for (index = 1; index < tree->node_schemas_count; index++) {
> +		if (tree->node_schemas[index].kind == CTLV_SCHEMA_NEST)
> +			continue;
> +		leaf = max(leaf,
> +			   ALIGN(ctlv_schema_attr_max_len(walk, tree, index, 0), CTLV_ALIGNTO));
> +	}

[Severity: Medium]
Does this calculation miss injected stub schemas? It iterates only over
tree->node_schemas_count, completely ignoring tree->stub_schemas.

This seems like it could miss any large leaves injected by stub fills,
underestimating the query reply buffer size (query_reply_min_len) and
potentially leading to message truncation in userspace.

> +	return (CTLV_MAX_NEST_DEPTH + 1) * sizeof(struct ctlv_attr) + leaf;
> +}
> +
> +static bool ctlv_schema_tree_reenters(const struct ctlv_schema_tree *tree)
> +{
> +	u32 index;
> +
> +	for (index = 0; index < tree->node_schemas_count; index++)
> +		if (tree->node_schemas[index].reenters)
> +			return true;

[Severity: Medium]
Will this loop return false when reentering nodes are present only inside stub
fills? Because it only checks tree->node_schemas_count, it might cause
ctlv_schema_op_sizes() to incorrectly fall back to ctlv_schema_min_len().

If that fallback occurs, ctlv_schema_min_len() would recursively descend into
the reentering stub fill until its depth exceeds CTLV_MAX_DECLARED_NEST_DEPTH.
At that point, walk->bad becomes true and valid schemas could be incorrectly
rejected with -EINVAL.

> +	return false;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015145053.3664509-1-jiri@resnulli.us?part=7