[PATCH v2 1/2] net: openvswitch: Use struct_size()

[PATCH v2 1/2] net: openvswitch: Use struct_size()

[Christophe JAILLET]

Use struct_size() instead of hand writing it.
This is less verbose and more robust.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
v2: No change

v1: https://lore.kernel.org/all/8be59c9e06fca8eff2f264abb4c2f74db0b19a9e.1696156198.git.christophe.jaillet@wanadoo.fr/


This is IMHO more readable, even if not perfect.

However (untested):
+	new = kzalloc(size_add(struct_size(new, masks, size),
			       size_mul(sizeof(u64), size)), GFP_KERNEL);
looks completely unreadable to me.
---
 net/openvswitch/flow_table.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index 4f3b1798e0b2..d108ae0bd0ee 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -220,16 +220,13 @@ static struct mask_array *tbl_mask_array_alloc(int size)
 	struct mask_array *new;
 
 	size = max(MASK_ARRAY_SIZE_MIN, size);
-	new = kzalloc(sizeof(struct mask_array) +
-		      sizeof(struct sw_flow_mask *) * size +
+	new = kzalloc(struct_size(new, masks, size) +
 		      sizeof(u64) * size, GFP_KERNEL);
 	if (!new)
 		return NULL;
 
 	new->masks_usage_zero_cntr = (u64 *)((u8 *)new +
-					     sizeof(struct mask_array) +
-					     sizeof(struct sw_flow_mask *) *
-					     size);
+					     struct_size(new, masks, size));
 
 	new->masks_usage_stats = __alloc_percpu(sizeof(struct mask_array_stats) +
 						sizeof(u64) * size,
-- 
2.34.1

[PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by

[Christophe JAILLET]

Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS
(for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
v2: Fix the subject  [Ilya Maximets]
    fix the field name used with __counted_by  [Ilya Maximets]

v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/


This patch is part of a work done in parallel of what is currently worked
on by Kees Cook.

My patches are only related to corner cases that do NOT match the
semantic of his Coccinelle script[1].

In this case, in tbl_mask_array_alloc(), several things are allocated with
a single allocation. Then, some pointer arithmetic computes the address of
the memory after the flex-array.

[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
---
 net/openvswitch/flow_table.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
index 9e659db78c05..f524dc3e4862 100644
--- a/net/openvswitch/flow_table.h
+++ b/net/openvswitch/flow_table.h
@@ -48,7 +48,7 @@ struct mask_array {
 	int count, max;
 	struct mask_array_stats __percpu *masks_usage_stats;
 	u64 *masks_usage_zero_cntr;
-	struct sw_flow_mask __rcu *masks[];
+	struct sw_flow_mask __rcu *masks[] __counted_by(max);
 };
 
 struct table_instance {
-- 
2.34.1

Re: [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by

[Kees Cook]

On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote:
> Prepare for the coming implementation by GCC and Clang of the __counted_by
> attribute. Flexible array members annotated with __counted_by can have
> their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS
> (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> functions).
> 
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> v2: Fix the subject  [Ilya Maximets]
>     fix the field name used with __counted_by  [Ilya Maximets]
> 
> v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/
> 
> 
> This patch is part of a work done in parallel of what is currently worked
> on by Kees Cook.
> 
> My patches are only related to corner cases that do NOT match the
> semantic of his Coccinelle script[1].
> 
> In this case, in tbl_mask_array_alloc(), several things are allocated with
> a single allocation. Then, some pointer arithmetic computes the address of
> the memory after the flex-array.
> 
> [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
> ---
>  net/openvswitch/flow_table.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
> index 9e659db78c05..f524dc3e4862 100644
> --- a/net/openvswitch/flow_table.h
> +++ b/net/openvswitch/flow_table.h
> @@ -48,7 +48,7 @@ struct mask_array {
>  	int count, max;
>  	struct mask_array_stats __percpu *masks_usage_stats;
>  	u64 *masks_usage_zero_cntr;
> -	struct sw_flow_mask __rcu *masks[];
> +	struct sw_flow_mask __rcu *masks[] __counted_by(max);
>  };

Yup, this looks correct to me. Thanks!

Reviewed-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

Re: [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by

[Julia Lawall]

On Sat, 14 Oct 2023, Kees Cook wrote:

> On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote:
> > Prepare for the coming implementation by GCC and Clang of the __counted_by
> > attribute. Flexible array members annotated with __counted_by can have
> > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS
> > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> > functions).
> >
> > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> > ---
> > v2: Fix the subject  [Ilya Maximets]
> >     fix the field name used with __counted_by  [Ilya Maximets]
> >
> > v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/
> >
> >
> > This patch is part of a work done in parallel of what is currently worked
> > on by Kees Cook.
> >
> > My patches are only related to corner cases that do NOT match the
> > semantic of his Coccinelle script[1].

What was the problem with the semantic patch in this case?

thanks,
julia


> >
> > In this case, in tbl_mask_array_alloc(), several things are allocated with
> > a single allocation. Then, some pointer arithmetic computes the address of
> > the memory after the flex-array.
> >
> > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
> > ---
> >  net/openvswitch/flow_table.h | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
> > index 9e659db78c05..f524dc3e4862 100644
> > --- a/net/openvswitch/flow_table.h
> > +++ b/net/openvswitch/flow_table.h
> > @@ -48,7 +48,7 @@ struct mask_array {
> >  	int count, max;
> >  	struct mask_array_stats __percpu *masks_usage_stats;
> >  	u64 *masks_usage_zero_cntr;
> > -	struct sw_flow_mask __rcu *masks[];
> > +	struct sw_flow_mask __rcu *masks[] __counted_by(max);
> >  };
>
> Yup, this looks correct to me. Thanks!
>
> Reviewed-by: Kees Cook <keescook@chromium.org>
>
> --
> Kees Cook
>

Re: [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by

[Christophe JAILLET]

Le 15/10/2023 à 06:53, Julia Lawall a écrit :
> 
> 
> On Sat, 14 Oct 2023, Kees Cook wrote:
> 
>> On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote:
>>> Prepare for the coming implementation by GCC and Clang of the __counted_by
>>> attribute. Flexible array members annotated with __counted_by can have
>>> their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS
>>> (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
>>> functions).
>>>
>>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>>> ---
>>> v2: Fix the subject  [Ilya Maximets]
>>>      fix the field name used with __counted_by  [Ilya Maximets]
>>>
>>> v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/
>>>
>>>
>>> This patch is part of a work done in parallel of what is currently worked
>>> on by Kees Cook.
>>>
>>> My patches are only related to corner cases that do NOT match the
>>> semantic of his Coccinelle script[1].
> 
> What was the problem with the semantic patch in this case?


The allocation in tbl_mask_array_alloc() looks like:
	new = kzalloc(sizeof(struct mask_array) +
		      sizeof(struct sw_flow_mask *) * size +
		      sizeof(u64) * size, GFP_KERNEL);


We allocated the struct, the ending flex aray *and* some more memory at 
the same time.

IIUC the cocci script, this extra space is not taken into account with 
the current script and it won't match.

CJ


> 
> thanks,
> julia
> 
> 
>>>
>>> In this case, in tbl_mask_array_alloc(), several things are allocated with
>>> a single allocation. Then, some pointer arithmetic computes the address of
>>> the memory after the flex-array.
>>>
>>> [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
>>> ---
>>>   net/openvswitch/flow_table.h | 2 +-
>>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
>>> index 9e659db78c05..f524dc3e4862 100644
>>> --- a/net/openvswitch/flow_table.h
>>> +++ b/net/openvswitch/flow_table.h
>>> @@ -48,7 +48,7 @@ struct mask_array {
>>>   	int count, max;
>>>   	struct mask_array_stats __percpu *masks_usage_stats;
>>>   	u64 *masks_usage_zero_cntr;
>>> -	struct sw_flow_mask __rcu *masks[];
>>> +	struct sw_flow_mask __rcu *masks[] __counted_by(max);
>>>   };
>>
>> Yup, this looks correct to me. Thanks!
>>
>> Reviewed-by: Kees Cook <keescook@chromium.org>
>>
>> --
>> Kees Cook
>>
> 

Re: [ovs-dev] [PATCH v2 2/2] net: openvswitch: Annotate struct mask_array with __counted_by

[Simon Horman]

On Sat, Oct 14, 2023 at 07:29:57PM -0700, Kees Cook wrote:
> On Sat, Oct 14, 2023 at 08:34:53AM +0200, Christophe JAILLET wrote:
> > Prepare for the coming implementation by GCC and Clang of the __counted_by
> > attribute. Flexible array members annotated with __counted_by can have
> > their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS
> > (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> > functions).
> > 
> > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> > ---
> > v2: Fix the subject  [Ilya Maximets]
> >     fix the field name used with __counted_by  [Ilya Maximets]
> > 
> > v1: https://lore.kernel.org/all/f66ddcf1ef9328f10292ea75a17b584359b6cde3.1696156198.git.christophe.jaillet@wanadoo.fr/
> > 
> > 
> > This patch is part of a work done in parallel of what is currently worked
> > on by Kees Cook.
> > 
> > My patches are only related to corner cases that do NOT match the
> > semantic of his Coccinelle script[1].
> > 
> > In this case, in tbl_mask_array_alloc(), several things are allocated with
> > a single allocation. Then, some pointer arithmetic computes the address of
> > the memory after the flex-array.
> > 
> > [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
> > ---
> >  net/openvswitch/flow_table.h | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/net/openvswitch/flow_table.h b/net/openvswitch/flow_table.h
> > index 9e659db78c05..f524dc3e4862 100644
> > --- a/net/openvswitch/flow_table.h
> > +++ b/net/openvswitch/flow_table.h
> > @@ -48,7 +48,7 @@ struct mask_array {
> >  	int count, max;
> >  	struct mask_array_stats __percpu *masks_usage_stats;
> >  	u64 *masks_usage_zero_cntr;
> > -	struct sw_flow_mask __rcu *masks[];
> > +	struct sw_flow_mask __rcu *masks[] __counted_by(max);
> >  };
> 
> Yup, this looks correct to me. Thanks!
> 
> Reviewed-by: Kees Cook <keescook@chromium.org>
> 

Likewise, I agree this is correct.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [ovs-dev] [PATCH v2 1/2] net: openvswitch: Use struct_size()

[Simon Horman]

On Sat, Oct 14, 2023 at 08:34:52AM +0200, Christophe JAILLET wrote:
> Use struct_size() instead of hand writing it.
> This is less verbose and more robust.
> 
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> v2: No change
> 
> v1: https://lore.kernel.org/all/8be59c9e06fca8eff2f264abb4c2f74db0b19a9e.1696156198.git.christophe.jaillet@wanadoo.fr/
> 
> 
> This is IMHO more readable, even if not perfect.
> 
> However (untested):
> +	new = kzalloc(size_add(struct_size(new, masks, size),
> 			       size_mul(sizeof(u64), size)), GFP_KERNEL);
> looks completely unreadable to me.

Thanks, this looks correct (and more readable) to me.

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH v2 1/2] net: openvswitch: Use struct_size()

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:

On Sat, 14 Oct 2023 08:34:52 +0200 you wrote:
> Use struct_size() instead of hand writing it.
> This is less verbose and more robust.
> 
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
> v2: No change
> 
> [...]

Here is the summary with links:
  - [v2,1/2] net: openvswitch: Use struct_size()
    https://git.kernel.org/netdev/net-next/c/df3bf90fef28
  - [v2,2/2] net: openvswitch: Annotate struct mask_array with __counted_by
    https://git.kernel.org/netdev/net-next/c/7713ec844756

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html