Hi Dan,
On 8/22/22 13:03, Dan Carpenter wrote:
> Hi Dmitry,
[..]
> ea66758c1795cef Paolo Abeni 2022-05-04 608 static void tcp_options_write(struct tcphdr *th, struct tcp_sock *tp,
[..]
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 622 #ifdef CONFIG_TCP_AO
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 623 if (unlikely(OPTION_AO & options)) {
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 624 u8 maclen;
> 33ad798c924b4a1 Adam Langley 2008-07-19 625
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 @626 if (tp) {
>
> Can "tp" really be NULL? Everything else assumes it can't.
It actually can be NULL, see tcp_make_synack().
At this moment code assumes that *either* (tp == NULL) or (tcprsk == NULL).
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 627 struct tcp_ao_info *ao_info;
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 628
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 629 ao_info = rcu_dereference_check(tp->ao_info,
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 630 lockdep_sock_is_held(&tp->inet_conn.icsk_inet.sk));
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 631 if (WARN_ON_ONCE(!ao_key || !ao_info || !ao_info->rnext_key))
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 632 goto out_ao;
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 633 maclen = tcp_ao_maclen(ao_key);
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 634 *ptr++ = htonl((TCPOPT_AO << 24) |
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 635 (tcp_ao_len(ao_key) << 16) |
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 636 (ao_key->sndid << 8) |
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 637 (ao_info->rnext_key->rcvid));
> 85df6b860d509a9 Dmitry Safonov 2022-08-18 638 }
>
> "maclen" not initialized on else path.
Patch 15 ("net/tcp: Wire TCP-AO to request sockets") adds
+ if (tcprsk) {
+ u8 aolen = tcprsk->maclen + sizeof(struct tcp_ao_hdr);
+
+ maclen = tcprsk->maclen;
+ *ptr++ = htonl((TCPOPT_AO << 24) | (aolen << 16) |
+ (tcprsk->ao_keyid << 8) |
+ (tcprsk->ao_rcv_next));
+ }
Assuming that tp != NULL OR tcprsk != NULL, maclen is always initialized
_after both patches_.
For version 2, I'll make it (break patches) in more bisect-able way for
static analyzers and do WARN_ON(tp == NULL && tcprsk == NULL) with break
off TCP-AO signing to make sure the assumption will be valid with
the code changing later on.
[..]
> ea66758c1795cef Paolo Abeni 2022-05-04 731 mptcp_options_write(th, ptr, tp, opts);
> ^^
> Not checked here either.
The function has checks inside.
Thanks,
Dmitry
