Re: [PATCH net-next v3 06/15] quic: add stream management

Simon Horman <[email protected]> Tue, 23 Sep 2025 10:09:51 +0100
Newsgroups dev.linux.lists.quic,dev.linux.lists.kernel-tls-handshake,org.kernel.vger.linux-cifs,org.kernel.vger.netdev
Message-ID <[email protected]>
On Thu, Sep 18, 2025 at 06:34:55PM -0400, Xin Long wrote:

...

> diff --git a/net/quic/stream.c b/net/quic/stream.c

...

> +/* Create and register new streams for sending. */
> +static struct quic_stream *quic_stream_send_create(struct quic_stream_table *streams,
> +						   s64 max_stream_id, u8 is_serv)
> +{
> +	struct quic_stream *stream;
> +	s64 stream_id;
> +
> +	stream_id = streams->send.next_bidi_stream_id;
> +	if (quic_stream_id_uni(max_stream_id))
> +		stream_id = streams->send.next_uni_stream_id;
> +
> +	/* rfc9000#section-2.1: A stream ID that is used out of order results in all streams
> +	 * of that type with lower-numbered stream IDs also being opened.
> +	 */
> +	while (stream_id <= max_stream_id) {
> +		stream = kzalloc(sizeof(*stream), GFP_KERNEL);
> +		if (!stream)
> +			return NULL;

...

> +	}
> +	return stream;

Hi Xin,

I'm unsure if can happen - actually I doubt it can - but
if the loop above iterates zero times then stream will be used
uninitialised here.

Likewise in quic_stream_recv_create().

Flagged by Smatch

...