Re: [syzbot] WARNING in mptcp_sendmsg_frag

Hello,

On Thu, 2021-09-23 at 17:37 +0300, Dan Carpenter wrote:

On Thu, Sep 23, 2021 at 05:19:42PM +0300, Dan Carpenter wrote:

quoted

On Wed, Sep 22, 2021 at 12:32:56PM +0200, Paolo Abeni wrote:

quoted

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The debug code helped a bit. It looks like we have singed/unsigned
comparisons issue

There should be a static checker warning for these.  I have created one
in response to your email.  It turns out there are a couple other
instances of this bug in the same file.

Thank you!

I was quite suprised the plain compiler did not emit a warn, even with
W=1.

quoted

net/mptcp/protocol.c:479 mptcp_subflow_could_cleanup() warn: unsigned subtraction: '(null)' use '!='

I should have checked my output a bit more carefully.  I don't want this
one to generate a warning.

quoted

net/mptcp/protocol.c:909 mptcp_frag_can_collapse_to() warn: unsigned subtraction: 'pfrag->size - pfrag->offset' use '!='

Likely "pfrag->offset" can't be larger than "pfrag->size".  Smatch has
some code to try track this information but it's not clever enough.

Yes, this looks safe, offset can't be larger than size.

Even the last reported warning looks safe to me: 'info->size_goal -
skb->len', we just check for size_goal being greater then skb->len.

Cheers,

Paolo