Re: [PATCH v2] net: ipv6: fix use-after-free Read in __xfrm6_tunnel_spi_lookup

From: kernel test robot
Date: Sun Jul 26 2020 - 03:34:46 EST

Hi K,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on ipsec/master]
[also build test WARNING on ipsec-next/master sparc-next/master net-next/master net/master v5.8-rc6 next-20200724]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in]

base: master
config: alpha-allyesconfig (attached as .config)
compiler: alpha-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=alpha

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@xxxxxxxxx>

All warnings (new ones prefixed by >>):

net/ipv6/xfrm6_tunnel.c: In function '__xfrm6_tunnel_spi_check':
>> net/ipv6/xfrm6_tunnel.c:106:43: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
106 | int index = xfrm6_tunnel_spi_hash_byaddr((const xfrm_address_t *)spi);
| ^

vim +106 net/ipv6/xfrm6_tunnel.c

102 static int __xfrm6_tunnel_spi_check(struct net *net, u32 spi)
103 {
104 struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
105 struct xfrm6_tunnel_spi *x6spi;
> 106 int index = xfrm6_tunnel_spi_hash_byaddr((const xfrm_address_t *)spi);
108 hlist_for_each_entry(x6spi,
109 &xfrm6_tn->spi_byaddr[index],
110 list_byspi) {
111 if (x6spi->spi == spi)
112 return -1;
113 }
114 return index;
115 }

0-DAY CI Kernel Test Service, Intel Corporation

Attachment: .config.gz
Description: application/gzip