Re: [PATCH 4/6] selftests/bpf: libarena: Add calloc() call

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] arena_calloc() can silently return partially uninitialized memory for large allocations due to early termination of arena_memset().
--

--- Patch [4]: [PATCH 4/6] selftests/bpf: libarena: Add calloc() call ---
commit 6f83c4438650c93f36d2b3ed9f3991f97c46a580
Author: Emil Tsalapatis <emil@etsalapatis.com>

selftests/bpf: libarena: Add calloc() call

This commit adds a calloc() operation to the arena memory allocator. It
provides zero-initialization for the allocated memory using a naive
memset implementation.

> diff --git a/tools/testing/selftests/bpf/libarena/include/libarena/common.h b/tools/testing/selftests/bpf/libarena/include/libarena/common.h
> --- a/tools/testing/selftests/bpf/libarena/include/libarena/common.h
> +++ b/tools/testing/selftests/bpf/libarena/include/libarena/common.h
> @@ -61,6 +62,23 @@ void arena_free(void __arena *ptr);
>   */
>  #define arena_subprog_init() do { asm volatile ("" :: "r"(&arena)); } while (0)
>  
> +/*
> + * BPF does not currently support the memset intrinsics. for large
> + * sequential copies, or assignments of large data structures,
> + * the frontend will generate an intrinsic that causes the BPF
> + * backend to exit due to a missing implementation. Provide
> + * implementations for the intrinsic.
> + */
> +static inline int arena_memset(s8 __arena *dst, s8 val, size_t size)
> +{
> +	size_t i;
> +
> +	for (i = zero; i < size && can_loop; i++)
> +		dst[i] = val;
> +
> +	return 0;
> +}

[Severity: Medium]
If the loop terminates early because the instruction limit is reached when
can_loop evaluates to false, will this function return 0 without indicating
to the caller that the memory was only partially written?

[ ... ]

> diff --git a/tools/testing/selftests/bpf/libarena/src/common.bpf.c b/tools/testing/selftests/bpf/libarena/src/common.bpf.c
> --- a/tools/testing/selftests/bpf/libarena/src/common.bpf.c
> +++ b/tools/testing/selftests/bpf/libarena/src/common.bpf.c

[ ... ]

> +__weak void __arena *arena_calloc(size_t ncount, size_t size)
> +{
> +	void __arena *mem;
> +	size_t total;
> +
> +	/*
> +	 * Ideally we'd be using __builtin_mul_overflow here,
> +	 * but the BPF compiler backend doesn't implement __multi3.
> +	 * There are ways to optimize the division away from the
> +	 * overflow check, but any costs are dwarfed by the
> +	 * buddy_alloc() call. Keep it simple for now.
> +	 */
> +	if (unlikely(ncount && size >= ULLONG_MAX / ncount))
> +		return NULL;
> +
> +	total = ncount * size;
> +
> +	mem = buddy_alloc(&buddy, total);
> +	if (likely(mem))
> +		arena_memset(mem, 0, total);
> +
> +	return mem;
> +}

[Severity: Medium]
Because arena_memset() always returns 0 even on early termination, could
arena_calloc() silently return a partially uninitialized buffer for large
allocations where the loop budget is exhausted?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260817191616.11071-1-emil@etsalapatis.com?part=4