Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

codeQL fixes #5

Closed
wants to merge 2 commits into from
Closed

codeQL fixes #5

wants to merge 2 commits into from

Conversation

andrewc12
Copy link

Signed-off-by: Andrew Innes andrew.c12@gmail.com

Motivation and Context

Description

How Has This Been Tested?

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Performance enhancement (non-breaking change which improves efficiency)
  • Code cleanup (non-breaking change which makes code smaller or more readable)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Library ABI change (libzfs, libzfs_core, libnvpair, libuutil and libzfsbootenv)
  • Documentation (a change to man pages or other documentation)

Checklist:

@andrewc12
Fix Multiplication converted to larger type
5272e42 
Signed-off-by: Andrew Innes <andrew.c12@gmail.com>
@andrewc12 andrewc12 changed the title Fix Multiplication converted to larger type codeQL fixes Oct 27, 2022
ryao
ryao requested changes Oct 27, 2022
View reviewed changes
Copy link
Owner

@ryao ryao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should have been opened against the upstream repository, rather than against my development repository.

cmd/raidz_test/raidz_test.c Outdated
@@ -937,7 +937,7 @@ run_sweep(void)
opts = umem_zalloc(sizeof (raidz_test_opts_t), UMEM_NOFAIL);
opts->rto_ashift = ashift_v[a];
opts->rto_dcols = dcols_v[d];
opts->rto_offset = (1 << ashift_v[a]) * rand();
opts->rto_offset = (uint64_t)(1 << ashift_v[a]) * rand();
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 here should be made 1ULL, which will avoid the need for an explicit cast.

tests/zfs-tests/cmd/stride_dd.c Outdated
@@ -195,11 +195,13 @@ main(int argc, char *argv[])
}

if (stride > 1) {
if (lseek(ifd, (stride - 1) * bsize, SEEK_CUR) == -1) {
if (lseek(ifd, ((uint64_t)stride - 1) * bsize,
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could probably use 1ULL here to make this a bit cleaner.

tests/zfs-tests/cmd/stride_dd.c Outdated
perror("input lseek");
exit(2);
}
if (lseek(ofd, (stride - 1) * bsize, SEEK_CUR) == -1) {
if (lseek(ofd, ((uint64_t)stride - 1) * bsize,
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same here.

@ryao
Copy link
Owner

ryao commented Oct 27, 2022

I had been planning to tackle this today, but you took most of that work away from me by tackling a number of them. That makes things easier for me, so I do not mind though. :)

@andrewc12
Copy link
Author

the only reason I did it on your repo is because I didn't see a way to prove it fixed something without the codeQL checks
and they wont merge the checks without the stuff being fixed first.
so ehh what else am I gonna do.

I will say though I have no idea if these are good changes
I generally tried to use the type of the target variable unless it was obscure in which case i used unit64_t.

@ryao
Copy link
Owner

ryao commented Oct 27, 2022

the only reason I did it on your repo is because I didn't see a way to prove it fixed something without the codeQL checks and they wont merge the checks without the stuff being fixed first. so ehh what else am I gonna do.

I will say though I have no idea if these are good changes I generally tried to use the type of the target variable unless it was obscure in which case i used unit64_t.

You can cherry-pick the commit from my repository and push it plus your changes to a branch on your repository. The result should then be visible in the code scanning page under the security tab after a half hour. You probably would need to change the search parameters from is:open branch:master to is:open branch:<your branch name here> for them to appear.

@ryao
Copy link
Owner

ryao commented Oct 27, 2022

That said, I do not particularly mind you (ab)using my development repository to run these checks, but github has security against running scans on PRs from new contributors, so I need to grant permission every time you do that, which will add significant latency to getting results. On your own repository, there is no need to wait for someone to grant permission.

@andrewc12
use ULL
0afef1e 
Signed-off-by: Andrew Innes <andrew.c12@gmail.com>
@andrewc12
Copy link
Author

andrewc12 commented Oct 27, 2022 •
edited

the only reason I did it on your repo is because I didn't see a way to prove it fixed something without the codeQL checks and they wont merge the checks without the stuff being fixed first. so ehh what else am I gonna do.
I will say though I have no idea if these are good changes I generally tried to use the type of the target variable unless it was obscure in which case i used unit64_t.

You can cherry-pick the commit from my repository and push it plus your changes to a branch on your repository. The result should then be visible in the code scanning page under the security tab after a half hour. You probably would need to change the search parameters from is:open branch:master to is:open branch:<your branch name here> for them to appear.

oh I did that. that's where these fixes come from,
my concern was i'd do a pr saying "this fixes these issues"
and someone would reply "what issues?"

so the fixes would have to go through you somehow.
also since Im also running the tests you don't need to keep approving them

@andrewc12
Copy link
Author

and honestly I don't know if its worth the back and forth to even have me fix these.
so ill probably just leave this alone unless you want me to work on it for some reason

@ryao
Copy link
Owner

ryao commented Oct 27, 2022

@andrewc12 Brian wants these to be fixed. If you do not fix them, I will. I already have fixes for the TOCTOU race condition complaints (with 1 exception that I deem to be a false positive that is a pain to workaround):

https://github.com/ryao/zfs/security/code-scanning?query=is%3Aopen+branch%3Asa

I plan to tackle the snprintf and formatting function complaints too. It would be helpful if you would open an upstream PR with a fix for the Multiplication result converted to larger type complaints.

@andrewc12
Copy link
Author

will do

@andrewc12 andrewc12 closed this Oct 27, 2022
ryao pushed a commit that referenced this pull request Feb 24, 2023
@rob-wing
FreeBSD: don't verify recycled vnode for zfs control directory
28251d8 
Under certain loads, the following panic is hit:

    panic: page fault
    KDB: stack backtrace:
    #0 0xffffffff805db025 at kdb_backtrace+0x65
    #1 0xffffffff8058e86f at vpanic+0x17f
    #2 0xffffffff8058e6e3 at panic+0x43
    #3 0xffffffff808adc15 at trap_fatal+0x385
    #4 0xffffffff808adc6f at trap_pfault+0x4f
    #5 0xffffffff80886da8 at calltrap+0x8
    openzfs#6 0xffffffff80669186 at vgonel+0x186
    openzfs#7 0xffffffff80669841 at vgone+0x31
    openzfs#8 0xffffffff8065806d at vfs_hash_insert+0x26d
    openzfs#9 0xffffffff81a39069 at sfs_vgetx+0x149
    openzfs#10 0xffffffff81a39c54 at zfsctl_snapdir_lookup+0x1e4
    openzfs#11 0xffffffff8065a28c at lookup+0x45c
    openzfs#12 0xffffffff806594b9 at namei+0x259
    openzfs#13 0xffffffff80676a33 at kern_statat+0xf3
    openzfs#14 0xffffffff8067712f at sys_fstatat+0x2f
    openzfs#15 0xffffffff808ae50c at amd64_syscall+0x10c
    openzfs#16 0xffffffff808876bb at fast_syscall_common+0xf8

The page fault occurs because vgonel() will call VOP_CLOSE() for active
vnodes. For this reason, define vop_close for zfsctl_ops_snapshot. While
here, define vop_open for consistency.

After adding the necessary vop, the bug progresses to the following
panic:

    panic: VERIFY3(vrecycle(vp) == 1) failed (0 == 1)
    cpuid = 17
    KDB: stack backtrace:
    #0 0xffffffff805e29c5 at kdb_backtrace+0x65
    #1 0xffffffff8059620f at vpanic+0x17f
    #2 0xffffffff81a27f4a at spl_panic+0x3a
    #3 0xffffffff81a3a4d0 at zfsctl_snapshot_inactive+0x40
    #4 0xffffffff8066fdee at vinactivef+0xde
    #5 0xffffffff80670b8a at vgonel+0x1ea
    openzfs#6 0xffffffff806711e1 at vgone+0x31
    openzfs#7 0xffffffff8065fa0d at vfs_hash_insert+0x26d
    openzfs#8 0xffffffff81a39069 at sfs_vgetx+0x149
    openzfs#9 0xffffffff81a39c54 at zfsctl_snapdir_lookup+0x1e4
    openzfs#10 0xffffffff80661c2c at lookup+0x45c
    openzfs#11 0xffffffff80660e59 at namei+0x259
    openzfs#12 0xffffffff8067e3d3 at kern_statat+0xf3
    openzfs#13 0xffffffff8067eacf at sys_fstatat+0x2f
    openzfs#14 0xffffffff808b5ecc at amd64_syscall+0x10c
    openzfs#15 0xffffffff8088f07b at fast_syscall_common+0xf8

This is caused by a race condition that can occur when allocating a new
vnode and adding that vnode to the vfs hash. If the newly created vnode
loses the race when being inserted into the vfs hash, it will not be
recycled as its usecount is greater than zero, hitting the above
assertion.

Fix this by dropping the assertion.

FreeBSD-issue: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=252700
Reviewed-by: Andriy Gapon <avg@FreeBSD.org>
Reviewed-by: Mateusz Guzik <mjguzik@gmail.com>
Reviewed-by: Alek Pinchuk <apinchuk@axcient.com>
Reviewed-by: Ryan Moeller <ryan@iXsystems.com>
Signed-off-by: Rob Wing <rob.wing@klarasystems.com>
Co-authored-by: Rob Wing <rob.wing@klarasystems.com>
Submitted-by: Klara, Inc.
Sponsored-by: rsync.net
Closes openzfs#14501
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ryao ryao ryao requested changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@andrewc12 @ryao