From mboxrd@z Thu Jan  1 00:00:00 1970
From: Eric Dumazet <eric.dumazet@gmail.com>
Subject: Re: [PATCH] ipv4: fib: avoid NULL dereference
Date: Fri, 6 Jul 2018 07:47:04 -0700
Message-ID: <3ad39534-400a-8d4e-ac50-94eb5655e565@gmail.com>
References: <20180706142836.1822-1-mark.rutland@arm.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>,
        "David S . Miller" <davem@davemloft.net>,
        Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>,
        netdev@vger.kernel.org
To: Mark Rutland <mark.rutland@arm.com>, linux-kernel@vger.kernel.org
Return-path: <linux-kernel-owner@vger.kernel.org>
In-Reply-To: <20180706142836.1822-1-mark.rutland@arm.com>
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
List-Id: netdev.vger.kernel.org



On 07/06/2018 07:28 AM, Mark Rutland wrote:
> In tnode_free() we iterate over a callback_head list with a while loop.
> At the start of the loop body we generate the next head pointer, and at
> the end of the loop body we generate the tn pointer for the next
> iteration of the loop by using container_of() on the head pointer to
> find the tnode, and deriving the kv pointer from this.
> 
> In the final iteration of the loop, this means that we derive a pointer
> from NULL, which is undefined behaviour, which UBSAN detects:

There is no dereference, your patch title is misleading.

UBSAN might be fooled, not the C compiler.