* [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()
@ 2025-04-08 13:42 Zijun Hu
2025-04-08 18:21 ` Kuniyuki Iwashima
2025-04-08 19:06 ` Eric Dumazet
0 siblings, 2 replies; 5+ messages in thread
From: Zijun Hu @ 2025-04-08 13:42 UTC (permalink / raw)
To: Eric Dumazet, Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn,
David S. Miller, Jakub Kicinski, Simon Horman, Pavel Emelyanov
Cc: Zijun Hu, Eric Dumazet, netdev, linux-kernel, Zijun Hu
From: Zijun Hu <quic_zijuhu@quicinc.com>
assign|release_proto_idx() wrongly check find_first_zero_bit() failure
by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
Also check @->inuse_idx before accessing @->val[] to avoid OOB.
Fixes: 13ff3d6fa4e6 ("[SOCK]: Enumerate struct proto-s to facilitate percpu inuse accounting (v2).")
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
---
include/net/sock.h | 5 ++++-
net/core/sock.c | 7 +++++--
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1421,7 +1421,10 @@ struct prot_inuse {
static inline void sock_prot_inuse_add(const struct net *net,
const struct proto *prot, int val)
{
- this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
+ unsigned int idx = prot->inuse_idx;
+
+ if (likely(idx < PROTO_INUSE_NR))
+ this_cpu_add(net->core.prot_inuse->val[idx], val);
}
static inline void sock_inuse_add(const struct net *net, int val)
diff --git a/net/core/sock.c b/net/core/sock.c
index 323892066def8ba517ff59f98f2e4ab47edd4e63..92f4618c576a3120bcc8e9d03d36738b77447360 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3948,6 +3948,9 @@ int sock_prot_inuse_get(struct net *net, struct proto *prot)
int cpu, idx = prot->inuse_idx;
int res = 0;
+ if (unlikely(idx >= PROTO_INUSE_NR))
+ return 0;
+
for_each_possible_cpu(cpu)
res += per_cpu_ptr(net->core.prot_inuse, cpu)->val[idx];
@@ -3999,7 +4002,7 @@ static int assign_proto_idx(struct proto *prot)
{
prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
- if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
+ if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) {
pr_err("PROTO_INUSE_NR exhausted\n");
return -ENOSPC;
}
@@ -4010,7 +4013,7 @@ static int assign_proto_idx(struct proto *prot)
static void release_proto_idx(struct proto *prot)
{
- if (prot->inuse_idx != PROTO_INUSE_NR - 1)
+ if (prot->inuse_idx != PROTO_INUSE_NR)
clear_bit(prot->inuse_idx, proto_inuse_idx);
}
#else
---
base-commit: 34a07c5b257453b5fcadc2408719c7b075844014
change-id: 20250405-fix_net-3e8364d302ff
Best regards,
--
Zijun Hu <quic_zijuhu@quicinc.com>
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()
2025-04-08 13:42 [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx() Zijun Hu
@ 2025-04-08 18:21 ` Kuniyuki Iwashima
2025-04-10 0:50 ` Zijun Hu
2025-04-08 19:06 ` Eric Dumazet
1 sibling, 1 reply; 5+ messages in thread
From: Kuniyuki Iwashima @ 2025-04-08 18:21 UTC (permalink / raw)
To: zijun_hu
Cc: dada1, davem, edumazet, horms, kuba, kuniyu, linux-kernel, netdev,
pabeni, quic_zijuhu, willemb, xemul
From: Zijun Hu <zijun_hu@icloud.com>
Date: Tue, 08 Apr 2025 21:42:34 +0800
> From: Zijun Hu <quic_zijuhu@quicinc.com>
>
> assign|release_proto_idx() wrongly check find_first_zero_bit() failure
> by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
>
> Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
> Also check @->inuse_idx before accessing @->val[] to avoid OOB.
>
> Fixes: 13ff3d6fa4e6 ("[SOCK]: Enumerate struct proto-s to facilitate percpu inuse accounting (v2).")
> Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
> ---
> include/net/sock.h | 5 ++++-
> net/core/sock.c | 7 +++++--
> 2 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -1421,7 +1421,10 @@ struct prot_inuse {
> static inline void sock_prot_inuse_add(const struct net *net,
> const struct proto *prot, int val)
> {
> - this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
> + unsigned int idx = prot->inuse_idx;
> +
> + if (likely(idx < PROTO_INUSE_NR))
> + this_cpu_add(net->core.prot_inuse->val[idx], val);
How does the else case happen ?
> }
>
> static inline void sock_inuse_add(const struct net *net, int val)
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 323892066def8ba517ff59f98f2e4ab47edd4e63..92f4618c576a3120bcc8e9d03d36738b77447360 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -3948,6 +3948,9 @@ int sock_prot_inuse_get(struct net *net, struct proto *prot)
> int cpu, idx = prot->inuse_idx;
> int res = 0;
>
> + if (unlikely(idx >= PROTO_INUSE_NR))
Same here.
> + return 0;
> +
> for_each_possible_cpu(cpu)
> res += per_cpu_ptr(net->core.prot_inuse, cpu)->val[idx];
>
> @@ -3999,7 +4002,7 @@ static int assign_proto_idx(struct proto *prot)
> {
> prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
>
> - if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
> + if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) {
> pr_err("PROTO_INUSE_NR exhausted\n");
> return -ENOSPC;
> }
> @@ -4010,7 +4013,7 @@ static int assign_proto_idx(struct proto *prot)
>
> static void release_proto_idx(struct proto *prot)
> {
> - if (prot->inuse_idx != PROTO_INUSE_NR - 1)
> + if (prot->inuse_idx != PROTO_INUSE_NR)
> clear_bit(prot->inuse_idx, proto_inuse_idx);
> }
> #else
>
> ---
> base-commit: 34a07c5b257453b5fcadc2408719c7b075844014
> change-id: 20250405-fix_net-3e8364d302ff
>
> Best regards,
> --
> Zijun Hu <quic_zijuhu@quicinc.com>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()
2025-04-08 18:21 ` Kuniyuki Iwashima
@ 2025-04-10 0:50 ` Zijun Hu
0 siblings, 0 replies; 5+ messages in thread
From: Zijun Hu @ 2025-04-10 0:50 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: dada1, davem, edumazet, horms, kuba, linux-kernel, netdev, pabeni,
quic_zijuhu, willemb, xemul
On 2025/4/9 02:21, Kuniyuki Iwashima wrote:
>> diff --git a/include/net/sock.h b/include/net/sock.h
>> index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
>> --- a/include/net/sock.h
>> +++ b/include/net/sock.h
>> @@ -1421,7 +1421,10 @@ struct prot_inuse {
>> static inline void sock_prot_inuse_add(const struct net *net,
>> const struct proto *prot, int val)
>> {
>> - this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
>> + unsigned int idx = prot->inuse_idx;
>> +
>> + if (likely(idx < PROTO_INUSE_NR))
>> + this_cpu_add(net->core.prot_inuse->val[idx], val);
> How does the else case happen ?
thank you for code review.
provided that @prot->inuse_idx will never be used if @prot fails to be
registered.
will remove this check in v2.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()
2025-04-08 13:42 [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx() Zijun Hu
2025-04-08 18:21 ` Kuniyuki Iwashima
@ 2025-04-08 19:06 ` Eric Dumazet
2025-04-10 0:52 ` Zijun Hu
1 sibling, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2025-04-08 19:06 UTC (permalink / raw)
To: Zijun Hu
Cc: Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, David S. Miller,
Jakub Kicinski, Simon Horman, Pavel Emelyanov, Eric Dumazet,
netdev, linux-kernel, Zijun Hu
On Tue, Apr 8, 2025 at 3:43 PM Zijun Hu <zijun_hu@icloud.com> wrote:
>
> From: Zijun Hu <quic_zijuhu@quicinc.com>
>
> assign|release_proto_idx() wrongly check find_first_zero_bit() failure
> by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
>
> Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
> Also check @->inuse_idx before accessing @->val[] to avoid OOB.
>
> Fixes: 13ff3d6fa4e6 ("[SOCK]: Enumerate struct proto-s to facilitate percpu inuse accounting (v2).")
> Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
> ---
> include/net/sock.h | 5 ++++-
> net/core/sock.c | 7 +++++--
> 2 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -1421,7 +1421,10 @@ struct prot_inuse {
> static inline void sock_prot_inuse_add(const struct net *net,
> const struct proto *prot, int val)
> {
> - this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
> + unsigned int idx = prot->inuse_idx;
> +
> + if (likely(idx < PROTO_INUSE_NR))
> + this_cpu_add(net->core.prot_inuse->val[idx], val);
> }
I do not think we are going to add such a test in the fast path, for a
bug that can not happen.
Please give us a reproducer ?
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()
2025-04-08 19:06 ` Eric Dumazet
@ 2025-04-10 0:52 ` Zijun Hu
0 siblings, 0 replies; 5+ messages in thread
From: Zijun Hu @ 2025-04-10 0:52 UTC (permalink / raw)
To: Eric Dumazet
Cc: Kuniyuki Iwashima, Paolo Abeni, Willem de Bruijn, David S. Miller,
Jakub Kicinski, Simon Horman, Pavel Emelyanov, Eric Dumazet,
netdev, linux-kernel, Zijun Hu
On 2025/4/9 03:06, Eric Dumazet wrote:
>> {
>> - this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
>> + unsigned int idx = prot->inuse_idx;
>> +
>> + if (likely(idx < PROTO_INUSE_NR))
>> + this_cpu_add(net->core.prot_inuse->val[idx], val);
>> }
> I do not think we are going to add such a test in the fast path, for a
> bug that can not happen.
>
agree.
> Please give us a reproducer ?
will remove that check in v2 provided @prot->inuse_idx will never be
used if @prot fails to be registered.
thank you for code review.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-04-10 0:53 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-04-08 13:42 [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx() Zijun Hu
2025-04-08 18:21 ` Kuniyuki Iwashima
2025-04-10 0:50 ` Zijun Hu
2025-04-08 19:06 ` Eric Dumazet
2025-04-10 0:52 ` Zijun Hu
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.