Re: [PATCH bpf-next] bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set

Alexei Starovoitov
2022-11-23T21:23:36Z

On Wed, Nov 23, 2022 at 7:58 AM Yonghong Song <yhs@fb.com> wrote:
>
> With CONFIG_DEBUG_INFO_BTF not set, we hit the following compilation error,
> /.../kernel/bpf/verifier.c:8196:23: error: array index 6 is past the end of the array
> (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
> if (meta->func_id == special_kfunc_list[KF_bpf_cast_to_kern_ctx])
> ^ ~~~~~~~~~~~~~~~~~~~~~~~
> /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
> BTF_ID_LIST(special_kfunc_list)
> ^
> /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
> #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
> ^
> /.../kernel/bpf/verifier.c:8443:19: error: array index 5 is past the end of the array
> (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
> btf_id == special_kfunc_list[KF_bpf_list_pop_back];
> ^ ~~~~~~~~~~~~~~~~~~~~
> /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
> BTF_ID_LIST(special_kfunc_list)
> ^
> /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
> #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
> ...
>
> Fix the problem by increase the size of BTF_ID_LIST to 8 to avoid compilation error
> and also prevent potentially unintended issue due to out-of-bound access.
>
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <error27@gmail.com>
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Signed-off-by: Yonghong Song <yhs@fb.com>
> ---
> include/linux/btf_ids.h | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h
> index c9744efd202f..71d0ce707744 100644
> --- a/include/linux/btf_ids.h
> +++ b/include/linux/btf_ids.h
> @@ -204,7 +204,7 @@ extern struct btf_id_set8 name;
>
> #else
>
> -#define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
> +#define BTF_ID_LIST(name) static u32 __maybe_unused name[8];

Changed it to 16 while applying so we don't have to bump it
again in the near future when another special kfunc is added.