All of lore.kernel.org
 help / color / mirror / Atom feed
From: Peter Seiderer <ps.report@gmx.net>
To: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
	"David S . Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Simon Horman <horms@kernel.org>, Shuah Khan <shuah@kernel.org>,
	Peter Seiderer <ps.report@gmx.net>,
	Fedor Pchelkin <pchelkin@ispras.ru>,
	Arnd Bergmann <arnd@arndb.de>, Nam Cao <namcao@linutronix.de>
Subject: [PATCH net-next v8 0/8] Some pktgen fixes/improvments (part II)
Date: Thu, 27 Feb 2025 14:55:56 +0100	[thread overview]
Message-ID: <20250227135604.40024-1-ps.report@gmx.net> (raw)

While taking a look at '[PATCH net] pktgen: Avoid out-of-range in
get_imix_entries' ([1]) and '[PATCH net v2] pktgen: Avoid out-of-bounds
access in get_imix_entries' ([2], [3]) and doing some tests and code review
I detected that the /proc/net/pktgen/... parsing logic does not honour the
user given buffer bounds (resulting in out-of-bounds access).

This can be observed e.g. by the following simple test (sometimes the
old/'longer' previous value is re-read from the buffer):

        $ echo add_device lo@0 > /proc/net/pktgen/kpktgend_0

        $ echo "min_pkt_size 12345" > /proc/net/pktgen/lo\@0 && grep min_pkt_size /proc/net/pktgen/lo\@0
Params: count 1000  min_pkt_size: 12345  max_pkt_size: 0
Result: OK: min_pkt_size=12345

        $ echo -n "min_pkt_size 123" > /proc/net/pktgen/lo\@0 && grep min_pkt_size /proc/net/pktgen/lo\@0
Params: count 1000  min_pkt_size: 12345  max_pkt_size: 0
Result: OK: min_pkt_size=12345

        $ echo "min_pkt_size 123" > /proc/net/pktgen/lo\@0 && grep min_pkt_size /proc/net/pktgen/lo\@0
Params: count 1000  min_pkt_size: 123  max_pkt_size: 0
Result: OK: min_pkt_size=123

So fix the out-of-bounds access (and some minor findings) and add a simple
proc_net_pktgen selftest...

Patch set splited into part I (now already applied to net-next)

- net: pktgen: replace ENOTSUPP with EOPNOTSUPP
- net: pktgen: enable 'param=value' parsing
- net: pktgen: fix hex32_arg parsing for short reads
- net: pktgen: fix 'rate 0' error handling (return -EINVAL)
- net: pktgen: fix 'ratep 0' error handling (return -EINVAL)
- net: pktgen: fix ctrl interface command parsing
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write()

nd part II (this one):

- net: pktgen: use defines for the various dec/hex number parsing digits lengths
- net: pktgen: fix mix of int/long
- net: pktgen: remove extra tmp variable (re-use len instead)
- net: pktgen: remove some superfluous variable initializing
- net: pktgen: fix mpls maximum labels list parsing
- net: pktgen: fix access outside of user given buffer in pktgen_if_write()
- net: pktgen: fix mpls reset parsing
- net: pktgen: remove all superfluous index assignements
- selftest: net: add proc_net_pktgen

Regards,
Peter

Changes v7 -> v8:
 - rebased on actual net-next/main
 - add rev-by Simon Horman
 - net: pktgen: fix mpls maximum labels list parsing
  - slightly rephrase commit message, omit '/16' (suggested by Paolo Abeni)
 - net: pktgen: fix mpls reset parsing
  - fix c99 comment (suggested by Paolo Abeni)
 - selftest: net: add proc_net_pktgen
  - fix c99 comments (suggested by Paolo Abeni)

Changes v6 -> v7:
  - rebased on actual net-next/main
  - selftest: net: add proc_net_pktgen
    - fixed conflict in tools/testing/selftests/net/config

Changes v5 -> v6:
 - add rev-by Simon Horman
 - drop patch 'net: pktgen: use defines for the various dec/hex number
   parsing digits lengths'
 - adjust to dropped patch 'net: pktgen: use defines for the various
   dec/hex number parsing digits lengths'
 - net: pktgen: fix mix of int/long
   - fix line break (suggested by Simon Horman)

Changes v4 -> v5:
 - split up patchset into part i/ii (suggested by Simon Horman)
 - add rev-by Simon Horman
 - net: pktgen: align some variable  declarations to the most common pattern
   -> net: pktgen: fix mix of int/long
   - instead of align to most common pattern (int) adjust all usages to
      size_t for i and max and ssize_t for len and adjust function signatures
      of hex32_arg(), count_trail_chars(), num_arg() and strn_len() accordingly
   - respect reverse xmas tree order for local variable declarations (where
        possible without too much code churn)
   - update subject line and patch description
 - dropped net: pktgen: hex32_arg/num_arg error out in case no characters are
   available
   - keep empty hex/num arg is implicit assumed as zero value
 - dropped net: pktgen: num_arg error out in case no valid character is parsed
   - keep empty hex/num arg is implicit assumed as zero value
 - Change patch description ('Fixes:' -> 'Addresses the following:',
   suggested by Simon Horman)
 - net: pktgen: remove all superfluous index assignements
   - new patch (suggested by Simon Horman)
 - selftest: net: add proc_net_pktgen
   - addapt to dropped patch 'net: pktgen: hex32_arg/num_arg error out in case
     no characters are available', empty hex/num arg is now implicit assumed as
     zero value (instead of failure)

Changes v3 -> v4:
 - add rev-by Simon Horman
 - new patch 'net: pktgen: use defines for the various dec/hex number parsing
   digits lengths' (suggested by Simon Horman)
 - replace C99 comment (suggested by Paolo Abeni)
 - drop available characters check in strn_len() (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: align some variable declarations to the
   most common pattern' (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: remove extra tmp variable (re-use len
   instead)' (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: remove some superfluous variable
   initializing' (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: fix mpls maximum labels list parsing'
   (suggested by Paolo Abeni)
 - factored out 'net: pktgen: hex32_arg/num_arg error out in case no
   characters are available' (suggested by Paolo Abeni)
 - factored out 'net: pktgen: num_arg error out in case no valid character
   is parsed' (suggested by Paolo Abeni)

Changes v2 -> v3:
 - new patch: 'net: pktgen: fix ctrl interface command parsing'
 - new patch: 'net: pktgen: fix mpls reset parsing'
 - tools/testing/selftests/net/proc_net_pktgen.c:
   - fix typo in change description ('v1 -> v1' and tyop)
   - rename some vars to better match usage
     add_loopback_0 -> thr_cmd_add_loopback_0
     rm_loopback_0 -> thr_cmd_rm_loopback_0
     wrong_ctrl_cmd -> wrong_thr_cmd
     legacy_ctrl_cmd -> legacy_thr_cmd
     ctrl_fd -> thr_fd
   - add ctrl interface tests

Changes v1 -> v2:
 - new patch: 'net: pktgen: fix hex32_arg parsing for short reads'
 - new patch: 'net: pktgen: fix 'rate 0' error handling (return -EINVAL)'
 - new patch: 'net: pktgen: fix 'ratep 0' error handling (return -EINVAL)'
 - net/core/pktgen.c: additional fix get_imix_entries() and get_labels()
 - tools/testing/selftests/net/proc_net_pktgen.c:
   - fix typo not vs. nod (suggested by Jakub Kicinski)
   - fix misaligned line (suggested by Jakub Kicinski)
   - enable fomerly commented out CONFIG_XFRM dependent test (command spi),
     as CONFIG_XFRM is enabled via tools/testing/selftests/net/config
     CONFIG_XFRM_INTERFACE/CONFIG_XFRM_USER (suggestex by Jakub Kicinski)
   - add CONFIG_NET_PKTGEN=m to tools/testing/selftests/net/config
     (suggested by Jakub Kicinski)
   - add modprobe pktgen to FIXTURE_SETUP() (suggested by Jakub Kicinski)
   - fix some checkpatch warnings (Missing a blank line after declarations)
   - shrink line length by re-naming some variables (command -> cmd,
     device -> dev)
   - add 'rate 0' testcase
   - add 'ratep 0' testcase

[1] https://lore.kernel.org/netdev/20241006221221.3744995-1-artem.chernyshev@red-soft.ru/
[2] https://lore.kernel.org/netdev/20250109083039.14004-1-pchelkin@ispras.ru/
[3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=76201b5979768500bca362871db66d77cb4c225e


Peter Seiderer (8):
  net: pktgen: fix mix of int/long
  net: pktgen: remove extra tmp variable (re-use len instead)
  net: pktgen: remove some superfluous variable initializing
  net: pktgen: fix mpls maximum labels list parsing
  net: pktgen: fix access outside of user given buffer in
    pktgen_if_write()
  net: pktgen: fix mpls reset parsing
  net: pktgen: remove all superfluous index assignements
  selftest: net: add proc_net_pktgen

 net/core/pktgen.c                             | 288 ++++----
 tools/testing/selftests/net/Makefile          |   1 +
 tools/testing/selftests/net/config            |   1 +
 tools/testing/selftests/net/proc_net_pktgen.c | 646 ++++++++++++++++++
 4 files changed, 805 insertions(+), 131 deletions(-)
 create mode 100644 tools/testing/selftests/net/proc_net_pktgen.c

-- 
2.48.1


             reply	other threads:[~2025-02-27 13:56 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-27 13:55 Peter Seiderer [this message]
2025-02-27 13:55 ` [PATCH net-next v8 1/8] net: pktgen: fix mix of int/long Peter Seiderer
2025-02-27 13:55 ` [PATCH net-next v8 2/8] net: pktgen: remove extra tmp variable (re-use len instead) Peter Seiderer
2025-02-27 13:55 ` [PATCH net-next v8 3/8] net: pktgen: remove some superfluous variable initializing Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 4/8] net: pktgen: fix mpls maximum labels list parsing Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 5/8] net: pktgen: fix access outside of user given buffer in pktgen_if_write() Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 6/8] net: pktgen: fix mpls reset parsing Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 7/8] net: pktgen: remove all superfluous index assignements Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 8/8] selftest: net: add proc_net_pktgen Peter Seiderer
2025-03-04 10:20 ` [PATCH net-next v8 0/8] Some pktgen fixes/improvments (part II) patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250227135604.40024-1-ps.report@gmx.net \
    --to=ps.report@gmx.net \
    --cc=arnd@arndb.de \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=namcao@linutronix.de \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pchelkin@ispras.ru \
    --cc=shuah@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.