net/ceph/osdmap.c:297 decode_array_32_alloc() warn: potential user controlled sizeof overflow 'len * 4' '1-u32max * 4'

BCC: [email protected]
CC: [email protected]
CC: [email protected]
TO: Marco Elver <[email protected]>
CC: "Vlastimil Babka (SUSE)" <[email protected]>
CC: "Harry Yoo (Oracle)" <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   3d6d817622b0a9721e3cc404df3469171582be13
commit: feb662d9168b63e1d4c02671ec96005410c6f3ce slab: support for compiler-assisted type-based slab cache partitioning
date:   3 months ago
:::::: branch date: 35 hours ago
:::::: commit date: 3 months ago
config: csky-randconfig-r073-20260813 (https://download.01.org/0day-ci/archive/20260814/[email protected]/config)
compiler: csky-linux-gcc (GCC) 16.1.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: feb662d9168b ("slab: support for compiler-assisted type-based slab cache partitioning")
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
net/ceph/osdmap.c:297 decode_array_32_alloc() warn: potential user controlled sizeof overflow 'len * 4' '1-u32max * 4'

Old smatch warnings:
net/ceph/osdmap.c:530 crush_decode() warn: potential user controlled sizeof overflow 'b->size * 4' '0-u32max * 4'

vim +297 net/ceph/osdmap.c

5cf9c4a9959b62 Ilya Dryomov 2017-06-22  280  
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  281  static u32 *decode_array_32_alloc(void **p, void *end, u32 *plen)
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  282  {
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  283  	u32 *a = NULL;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  284  	u32 len;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  285  	int ret;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  286  
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  287  	ceph_decode_32_safe(p, end, len, e_inval);
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  288  	if (len) {
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  289  		u32 i;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  290  
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  291  		a = kmalloc_array(len, sizeof(u32), GFP_NOIO);
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  292  		if (!a) {
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  293  			ret = -ENOMEM;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  294  			goto fail;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  295  		}
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  296  
5cf9c4a9959b62 Ilya Dryomov 2017-06-22 @297  		ceph_decode_need(p, end, len * sizeof(u32), e_inval);
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  298  		for (i = 0; i < len; i++)
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  299  			a[i] = ceph_decode_32(p);
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  300  	}
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  301  
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  302  	*plen = len;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  303  	return a;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  304  
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  305  e_inval:
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  306  	ret = -EINVAL;
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  307  fail:
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  308  	kfree(a);
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  309  	return ERR_PTR(ret);
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  310  }
5cf9c4a9959b62 Ilya Dryomov 2017-06-22  311  

:::::: The code at line 297 was first introduced by commit
:::::: 5cf9c4a9959b6273675310d14a834ef14fbca37c libceph, crush: per-pool crush_choose_arg_map for crush_do_rule()

:::::: TO: Ilya Dryomov <[email protected]>
:::::: CC: Ilya Dryomov <[email protected]>

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki