Re: [PATCH] assoc_array: don't call compare_object() on a node

Path	csiph.com!news.redatomik.org!aioe.org!bofh.it!news.nic.it!robomod
From	Jerome Marchand <jmarchan@redhat.com>
Newsgroups	linux.kernel
Subject	Re: [PATCH] assoc_array: don't call compare_object() on a node
Date	Mon, 22 Feb 2016 18:00:01 +0100
Message-ID	<r5201-eH-11@gated-at.bofh.it> (permalink)
References	<r51nj-8j5-9@gated-at.bofh.it> <r51GH-8uQ-41@gated-at.bofh.it>
X-Original-To	David Howells <dhowells@redhat.com>
X-Enigmail-Draft-Status	N1110
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0
MIME-Version	1.0
Content-Type	multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="EbqWnawiPjSdaetfuwTsJG94fMuSD04OF"
X-Scanned-By	MIMEDefang 2.68 on 10.5.11.23
X-Greylist	Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Mon, 22 Feb 2016 16:57:27 +0000 (UTC)
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	87
Organization	linux.* mail to news gateway
X-Original-Cc	keyrings@vger.kernel.org, linux-kernel@vger.kernel.org
X-Original-Date	Mon, 22 Feb 2016 17:57:20 +0100
X-Original-Message-ID	<56CB3DF0.9020805@redhat.com>
X-Original-References	<1456157620-20819-1-git-send-email-jmarchan@redhat.com> <12613.1456159058@warthog.procyon.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1339726

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

On 02/22/2016 05:37 PM, David Howells wrote:
> Jerome Marchand <jmarchan@redhat.com> wrote:
> 
>> In assoc_array_insert_into_terminal_node(), we call the
>> compare_object() method on all empty slots,

Sorry, this is a typo. It should be "on all non-empty slots".

> 
> Ummm...  That shouldn't happen - the:
> 
> 		if (!ptr) {
> 			free_slot = i;
> 			continue;
> 		}
> 
> preceding the line you modified should cause the comparison to be skipped on a
> slot if it's empty.
> 
>> even when they're not leaves, passing a pointer to an unexpected structure
>> to compare_object().
> 
> Do you instead mean a metadata pointer rather than an empty slot?

Yes. In the cases I debugged, it was a node, but I guess we could
encounter a shortcut here too.

> 
>> Currently it causes an out-of-bound read access in keyring_compare_object
>> detected by KASan.  The issue is easily reproduced with keyutils testsuite.
> 
> I don't see it.  Did you modify the testsuite, or is it a matter of running it
> often enough?

Do you have KASan enabled? In my experience, the reproduction is
systematic on some test (e.g. keyctl/unlink/all). AFAIK, the testsuite
isn't modify (it's from Red Hat test infrastructure).

> 
> Also, can you include the oops output you get in the patch description,
> please?

Sure.

> 
> That said, I can see that there is probably an issue that your patch fixes -
> but it's not quite the one you describe (see above).

Does the description sounds correct if you add the missing negation?

Jerome
> 
> David
>

Thread

[PATCH] assoc_array: don't call compare_object() on a node "Jerome Marchand" <jmarchan@redhat.com> - 2016-02-22 17:20 +0100
  Re: [PATCH] assoc_array: don't call compare_object() on a node David Howells <dhowells@redhat.com> - 2016-02-22 17:40 +0100
    Re: [PATCH] assoc_array: don't call compare_object() on a node Jerome Marchand <jmarchan@redhat.com> - 2016-02-22 18:00 +0100
  [PATCH V2] assoc_array: don't call compare_object() on a node "Jerome Marchand" <jmarchan@redhat.com> - 2016-02-23 11:30 +0100

csiph-web