* [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by [not found] <e5122b4ff878cbf3ed72653a395ad5c4da04dc1e.1697264974.git.christophe.jaillet@wanadoo.fr> @ 2023-10-14 6:34 ` Christophe JAILLET 2023-10-15 2:29 ` Kees Cook 0 siblings, 1 reply; 5+ messages in thread From: Christophe JAILLET @ 2023-10-14 6:34 UTC (permalink / raw) To: Pravin B Shelar, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Kees Cook, Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers, Tom Rix Cc: linux-kernel, kernel-janitors, Christophe JAILLET, netdev, dev, linux-hardening, llvm Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> --- v2: Fix the subject [Ilya Maximets] fix the field name used with __counted_by [Ilya Maximets] v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/ This patch is part of a work done in parallel of what is currently worked on by Kees Cook. My patches are only related to corner cases that do NOT match the semantic of his Coccinelle script[1]. In this case, in tbl_mask_array_alloc(), several things are allocated with a single allocation. Then, some pointer arithmetic computes the address of the memory after the flex-array. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci --- net/openvswitch/flow_table.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h index 9e659db78c05..f524dc3e4862 100644 --- a/net/openvswitch/flow_table.h +++ b/net/openvswitch/flow_table.h @@ -48,7 +48,7 @@ struct mask_array { int count, max; struct mask_array_stats __percpu *masks_usage_stats; u64 *masks_usage_zero_cntr; - struct sw_flow_mask __rcu *masks[]; + struct sw_flow_mask __rcu *masks[] __counted_by(max); }; struct table_instance { -- 2.34.1 ^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by 2023-10-14 6:34 ` [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by Christophe JAILLET @ 2023-10-15 2:29 ` Kees Cook 2023-10-15 4:53 ` Julia Lawall 2023-10-17 9:10 ` [ovs-dev] " Simon Horman 0 siblings, 2 replies; 5+ messages in thread From: Kees Cook @ 2023-10-15 2:29 UTC (permalink / raw) To: Christophe JAILLET Cc: Pravin B Shelar, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers, Tom Rix, linux-kernel, kernel-janitors, netdev, dev, linux-hardening, llvm On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote: > Prepare for the coming implementation by GCC and Clang of the __counted_by > attribute. Flexible array members annotated with __counted_by can have > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > functions). > > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > --- > v2: Fix the subject [Ilya Maximets] > fix the field name used with __counted_by [Ilya Maximets] > > v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/ > > > This patch is part of a work done in parallel of what is currently worked > on by Kees Cook. > > My patches are only related to corner cases that do NOT match the > semantic of his Coccinelle script[1]. > > In this case, in tbl_mask_array_alloc(), several things are allocated with > a single allocation. Then, some pointer arithmetic computes the address of > the memory after the flex-array. > > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci > --- > net/openvswitch/flow_table.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h > index 9e659db78c05..f524dc3e4862 100644 > --- a/net/openvswitch/flow_table.h > +++ b/net/openvswitch/flow_table.h > @@ -48,7 +48,7 @@ struct mask_array { > int count, max; > struct mask_array_stats __percpu *masks_usage_stats; > u64 *masks_usage_zero_cntr; > - struct sw_flow_mask __rcu *masks[]; > + struct sw_flow_mask __rcu *masks[] __counted_by(max); > }; Yup, this looks correct to me. Thanks! Reviewed-by: Kees Cook <keescook@chromium.org> -- Kees Cook ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by 2023-10-15 2:29 ` Kees Cook @ 2023-10-15 4:53 ` Julia Lawall 2023-10-15 7:20 ` Christophe JAILLET 2023-10-17 9:10 ` [ovs-dev] " Simon Horman 1 sibling, 1 reply; 5+ messages in thread From: Julia Lawall @ 2023-10-15 4:53 UTC (permalink / raw) To: Kees Cook Cc: Christophe JAILLET, Pravin B Shelar, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers, Tom Rix, linux-kernel, kernel-janitors, netdev, dev, linux-hardening, llvm On Sat, 14 Oct 2023, Kees Cook wrote: > On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote: > > Prepare for the coming implementation by GCC and Clang of the __counted_by > > attribute. Flexible array members annotated with __counted_by can have > > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS > > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > > functions). > > > > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > > --- > > v2: Fix the subject [Ilya Maximets] > > fix the field name used with __counted_by [Ilya Maximets] > > > > v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/ > > > > > > This patch is part of a work done in parallel of what is currently worked > > on by Kees Cook. > > > > My patches are only related to corner cases that do NOT match the > > semantic of his Coccinelle script[1]. What was the problem with the semantic patch in this case? thanks, julia > > > > In this case, in tbl_mask_array_alloc(), several things are allocated with > > a single allocation. Then, some pointer arithmetic computes the address of > > the memory after the flex-array. > > > > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci > > --- > > net/openvswitch/flow_table.h | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h > > index 9e659db78c05..f524dc3e4862 100644 > > --- a/net/openvswitch/flow_table.h > > +++ b/net/openvswitch/flow_table.h > > @@ -48,7 +48,7 @@ struct mask_array { > > int count, max; > > struct mask_array_stats __percpu *masks_usage_stats; > > u64 *masks_usage_zero_cntr; > > - struct sw_flow_mask __rcu *masks[]; > > + struct sw_flow_mask __rcu *masks[] __counted_by(max); > > }; > > Yup, this looks correct to me. Thanks! > > Reviewed-by: Kees Cook <keescook@chromium.org> > > -- > Kees Cook > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by 2023-10-15 4:53 ` Julia Lawall @ 2023-10-15 7:20 ` Christophe JAILLET 0 siblings, 0 replies; 5+ messages in thread From: Christophe JAILLET @ 2023-10-15 7:20 UTC (permalink / raw) To: Julia Lawall, Kees Cook Cc: Pravin B Shelar, David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni, Gustavo A. R. Silva, Nathan Chancellor, Nick Desaulniers, Tom Rix, linux-kernel, kernel-janitors, netdev, dev, linux-hardening, llvm Le 15/10/2023 à 06:53, Julia Lawall a écrit : > > > On Sat, 14 Oct 2023, Kees Cook wrote: > >> On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote: >>> Prepare for the coming implementation by GCC and Clang of the __counted_by >>> attribute. Flexible array members annotated with __counted_by can have >>> their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS >>> (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family >>> functions). >>> >>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> >>> --- >>> v2: Fix the subject [Ilya Maximets] >>> fix the field name used with __counted_by [Ilya Maximets] >>> >>> v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/ >>> >>> >>> This patch is part of a work done in parallel of what is currently worked >>> on by Kees Cook. >>> >>> My patches are only related to corner cases that do NOT match the >>> semantic of his Coccinelle script[1]. > > What was the problem with the semantic patch in this case? The allocation in tbl_mask_array_alloc() looks like: new = kzalloc(sizeof(struct mask_array) + sizeof(struct sw_flow_mask *) * size + sizeof(u64) * size, GFP_KERNEL); We allocated the struct, the ending flex aray *and* some more memory at the same time. IIUC the cocci script, this extra space is not taken into account with the current script and it won't match. CJ > > thanks, > julia > > >>> >>> In this case, in tbl_mask_array_alloc(), several things are allocated with >>> a single allocation. Then, some pointer arithmetic computes the address of >>> the memory after the flex-array. >>> >>> [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci >>> --- >>> net/openvswitch/flow_table.h | 2 +- >>> 1 file changed, 1 insertion(+), 1 deletion(-) >>> >>> diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h >>> index 9e659db78c05..f524dc3e4862 100644 >>> --- a/net/openvswitch/flow_table.h >>> +++ b/net/openvswitch/flow_table.h >>> @@ -48,7 +48,7 @@ struct mask_array { >>> int count, max; >>> struct mask_array_stats __percpu *masks_usage_stats; >>> u64 *masks_usage_zero_cntr; >>> - struct sw_flow_mask __rcu *masks[]; >>> + struct sw_flow_mask __rcu *masks[] __counted_by(max); >>> }; >> >> Yup, this looks correct to me. Thanks! >> >> Reviewed-by: Kees Cook <keescook@chromium.org> >> >> -- >> Kees Cook >> > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [ovs-dev] [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by 2023-10-15 2:29 ` Kees Cook 2023-10-15 4:53 ` Julia Lawall @ 2023-10-17 9:10 ` Simon Horman 1 sibling, 0 replies; 5+ messages in thread From: Simon Horman @ 2023-10-17 9:10 UTC (permalink / raw) To: Kees Cook Cc: Christophe JAILLET, dev, kernel-janitors, Tom Rix, llvm, Nick Desaulniers, Gustavo A. R. Silva, Nathan Chancellor, Eric Dumazet, linux-hardening, netdev, Jakub Kicinski, Paolo Abeni, David S. Miller, linux-kernel On Sat, Oct 14, 2023 at 07:29:57PM -0700, Kees Cook wrote: > On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote: > > Prepare for the coming implementation by GCC and Clang of the __counted_by > > attribute. Flexible array members annotated with __counted_by can have > > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS > > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > > functions). > > > > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > > --- > > v2: Fix the subject [Ilya Maximets] > > fix the field name used with __counted_by [Ilya Maximets] > > > > v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/ > > > > > > This patch is part of a work done in parallel of what is currently worked > > on by Kees Cook. > > > > My patches are only related to corner cases that do NOT match the > > semantic of his Coccinelle script[1]. > > > > In this case, in tbl_mask_array_alloc(), several things are allocated with > > a single allocation. Then, some pointer arithmetic computes the address of > > the memory after the flex-array. > > > > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci > > --- > > net/openvswitch/flow_table.h | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h > > index 9e659db78c05..f524dc3e4862 100644 > > --- a/net/openvswitch/flow_table.h > > +++ b/net/openvswitch/flow_table.h > > @@ -48,7 +48,7 @@ struct mask_array { > > int count, max; > > struct mask_array_stats __percpu *masks_usage_stats; > > u64 *masks_usage_zero_cntr; > > - struct sw_flow_mask __rcu *masks[]; > > + struct sw_flow_mask __rcu *masks[] __counted_by(max); > > }; > > Yup, this looks correct to me. Thanks! > > Reviewed-by: Kees Cook <keescook@chromium.org> > Likewise, I agree this is correct. Reviewed-by: Simon Horman <horms@kernel.org> ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2023-10-17 9:10 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <e5122b4ff878cbf3ed72653a395ad5c4da04dc1e.1697264974.git.christophe.jaillet@wanadoo.fr>
2023-10-14 6:34 ` [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by Christophe JAILLET
2023-10-15 2:29 ` Kees Cook
2023-10-15 4:53 ` Julia Lawall
2023-10-15 7:20 ` Christophe JAILLET
2023-10-17 9:10 ` [ovs-dev] " Simon Horman
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).