From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, Pavitra Jha <jhapavitra98@gmail.com>,
idryomov@gmail.com
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
Slava.Dubeyko@ibm.com, amarkuze@redhat.com,
ceph-devel@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org, Pavitra Jha <jhapavitra98@gmail.com>
Subject: Re: [PATCH v2] ceph: fix bare ceph_decode_8 OOB in decode_lockers()
Date: Sat, 30 May 2026 20:46:31 +0300 [thread overview]
Message-ID: <202605310022.LGyGb8eD-lkp@intel.com> (raw)
In-Reply-To: <20260528132521.843004-1-jhapavitra98@gmail.com>
Hi Pavitra,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Pavitra-Jha/ceph-fix-bare-ceph_decode_8-OOB-in-decode_lockers/20260528-212749
base: https://github.com/ceph/ceph-client.git testing
patch link: https://lore.kernel.org/r/20260528132521.843004-1-jhapavitra98%40gmail.com
patch subject: [PATCH v2] ceph: fix bare ceph_decode_8 OOB in decode_lockers()
config: um-randconfig-r073-20260530 (https://download.01.org/0day-ci/archive/20260531/202605310022.LGyGb8eD-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605310022.LGyGb8eD-lkp@intel.com/
smatch warnings:
net/ceph/cls_lock_client.c:313 decode_lockers() warn: missing error code 'ret'
vim +/ret +313 net/ceph/cls_lock_client.c
d4ed4a53056288 Douglas Fuller 2015-06-29 288 static int decode_lockers(void **p, void *end, u8 *type, char **tag,
d4ed4a53056288 Douglas Fuller 2015-06-29 289 struct ceph_locker **lockers, u32 *num_lockers)
d4ed4a53056288 Douglas Fuller 2015-06-29 290 {
d4ed4a53056288 Douglas Fuller 2015-06-29 291 u8 struct_v;
d4ed4a53056288 Douglas Fuller 2015-06-29 292 u32 struct_len;
d4ed4a53056288 Douglas Fuller 2015-06-29 293 char *s;
d4ed4a53056288 Douglas Fuller 2015-06-29 294 int i;
d4ed4a53056288 Douglas Fuller 2015-06-29 295 int ret;
d4ed4a53056288 Douglas Fuller 2015-06-29 296
d4ed4a53056288 Douglas Fuller 2015-06-29 297 ret = ceph_start_decoding(p, end, 1, "cls_lock_get_info_reply",
d4ed4a53056288 Douglas Fuller 2015-06-29 298 &struct_v, &struct_len);
d4ed4a53056288 Douglas Fuller 2015-06-29 299 if (ret)
d4ed4a53056288 Douglas Fuller 2015-06-29 300 return ret;
d4ed4a53056288 Douglas Fuller 2015-06-29 301
d4ed4a53056288 Douglas Fuller 2015-06-29 302 *num_lockers = ceph_decode_32(p);
69050f8d6d075d Kees Cook 2026-02-20 303 *lockers = kzalloc_objs(**lockers, *num_lockers, GFP_NOIO);
d4ed4a53056288 Douglas Fuller 2015-06-29 304 if (!*lockers)
d4ed4a53056288 Douglas Fuller 2015-06-29 305 return -ENOMEM;
d4ed4a53056288 Douglas Fuller 2015-06-29 306
d4ed4a53056288 Douglas Fuller 2015-06-29 307 for (i = 0; i < *num_lockers; i++) {
d4ed4a53056288 Douglas Fuller 2015-06-29 308 ret = decode_locker(p, end, *lockers + i);
d4ed4a53056288 Douglas Fuller 2015-06-29 309 if (ret)
d4ed4a53056288 Douglas Fuller 2015-06-29 310 goto err_free_lockers;
d4ed4a53056288 Douglas Fuller 2015-06-29 311 }
d4ed4a53056288 Douglas Fuller 2015-06-29 312
cff58e4599d8e1 Pavitra Jha 2026-05-28 @313 ceph_decode_8_safe(p, end, *type, err_free_lockers);
This macro has a goto err_free_lockers but the error code isn't set.
d4ed4a53056288 Douglas Fuller 2015-06-29 314 s = ceph_extract_encoded_string(p, end, NULL, GFP_NOIO);
d4ed4a53056288 Douglas Fuller 2015-06-29 315 if (IS_ERR(s)) {
d4ed4a53056288 Douglas Fuller 2015-06-29 316 ret = PTR_ERR(s);
d4ed4a53056288 Douglas Fuller 2015-06-29 317 goto err_free_lockers;
d4ed4a53056288 Douglas Fuller 2015-06-29 318 }
d4ed4a53056288 Douglas Fuller 2015-06-29 319
d4ed4a53056288 Douglas Fuller 2015-06-29 320 *tag = s;
d4ed4a53056288 Douglas Fuller 2015-06-29 321 return 0;
d4ed4a53056288 Douglas Fuller 2015-06-29 322
d4ed4a53056288 Douglas Fuller 2015-06-29 323 err_free_lockers:
d4ed4a53056288 Douglas Fuller 2015-06-29 324 ceph_free_lockers(*lockers, *num_lockers);
d4ed4a53056288 Douglas Fuller 2015-06-29 325 return ret;
d4ed4a53056288 Douglas Fuller 2015-06-29 326 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2026-05-30 17:46 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-23 1:46 [PATCH] ceph: fix OOB read in decode_lockers() via missing bounds check Pavitra Jha
2026-05-26 19:04 ` Viacheslav Dubeyko
2026-05-28 13:25 ` [PATCH v2] ceph: fix bare ceph_decode_8 OOB in decode_lockers() Pavitra Jha
2026-05-28 18:06 ` Viacheslav Dubeyko
2026-05-30 17:46 ` Dan Carpenter [this message]
2026-06-02 4:17 ` [PATCH v3] ceph: fix two unsafe bare decodes " Pavitra Jha
2026-06-02 16:46 ` Viacheslav Dubeyko
2026-05-28 14:36 ` [PATCH] ceph: fix OOB read in decode_lockers() via missing bounds check Pavitra Jha
2026-05-28 18:14 [PATCH v2] ceph: fix multiple unsafe decodes in decode_locker() Viacheslav Dubeyko
2026-05-28 18:17 ` [PATCH v2] ceph: fix bare ceph_decode_8 OOB in decode_lockers() Pavitra Jha
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202605310022.LGyGb8eD-lkp@intel.com \
--to=error27@gmail.com \
--cc=Slava.Dubeyko@ibm.com \
--cc=amarkuze@redhat.com \
--cc=ceph-devel@vger.kernel.org \
--cc=idryomov@gmail.com \
--cc=jhapavitra98@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome