[bug report] bpf: Refactor map->off_arr handling

[bug report] bpf: Refactor map->off_arr handling

[Dan Carpenter]

Hello Kumar Kartikeya Dwivedi,

The patch f71b2f64177a: "bpf: Refactor map->off_arr handling" from
Nov 4, 2022, leads to the following Smatch static checker warning:

	kernel/bpf/btf.c:3597 btf_parse_field_offs()
	warn: potential pointer math issue ('off' is a 32 bit pointer)

kernel/bpf/btf.c
    3580 struct btf_field_offs *btf_parse_field_offs(struct btf_record *rec)
    3581 {
    3582         struct btf_field_offs *foffs;
    3583         u32 i, *off;
    3584         u8 *sz;
    3585 
    3586         BUILD_BUG_ON(ARRAY_SIZE(foffs->field_off) != ARRAY_SIZE(foffs->field_sz));
    3587         if (IS_ERR_OR_NULL(rec) || WARN_ON_ONCE(rec->cnt > sizeof(foffs->field_off)))
                                                                    ^^^^^^^^^^^^^^^^^^^^^^^^
s/sizeof/ARRAY_SIZE/

    3588                 return NULL;
    3589 
    3590         foffs = kzalloc(sizeof(*foffs), GFP_KERNEL | __GFP_NOWARN);
    3591         if (!foffs)
    3592                 return ERR_PTR(-ENOMEM);
    3593 
    3594         off = foffs->field_off;
    3595         sz = foffs->field_sz;
    3596         for (i = 0; i < rec->cnt; i++) {
--> 3597                 off[i] = rec->fields[i].offset;
    3598                 sz[i] = btf_field_type_size(rec->fields[i].type);
    3599         }
    3600         foffs->cnt = rec->cnt;
    3601 
    3602         if (foffs->cnt == 1)
    3603                 return foffs;
    3604         sort_r(foffs->field_off, foffs->cnt, sizeof(foffs->field_off[0]),
    3605                btf_field_offs_cmp, btf_field_offs_swap, foffs);
    3606         return foffs;
    3607 }

regards,
dan carpenter

Re: [bug report] bpf: Refactor map->off_arr handling

[Kumar Kartikeya Dwivedi]

On Tue, Nov 15, 2022 at 06:34:43PM IST, Dan Carpenter wrote:
> Hello Kumar Kartikeya Dwivedi,
>
> The patch f71b2f64177a: "bpf: Refactor map->off_arr handling" from
> Nov 4, 2022, leads to the following Smatch static checker warning:
>
> 	kernel/bpf/btf.c:3597 btf_parse_field_offs()
> 	warn: potential pointer math issue ('off' is a 32 bit pointer)
>
> kernel/bpf/btf.c
>     3580 struct btf_field_offs *btf_parse_field_offs(struct btf_record *rec)
>     3581 {
>     3582         struct btf_field_offs *foffs;
>     3583         u32 i, *off;
>     3584         u8 *sz;
>     3585
>     3586         BUILD_BUG_ON(ARRAY_SIZE(foffs->field_off) != ARRAY_SIZE(foffs->field_sz));
>     3587         if (IS_ERR_OR_NULL(rec) || WARN_ON_ONCE(rec->cnt > sizeof(foffs->field_off)))
>                                                                     ^^^^^^^^^^^^^^^^^^^^^^^^
> s/sizeof/ARRAY_SIZE/
>

Thanks for the report, but this one I noticed already and fixed in:
2d577252579b ("bpf: Remove BPF_MAP_OFF_ARR_MAX")