netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Peter Seiderer <ps.report@gmx.net>
To: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org,
	"David S . Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Simon Horman <horms@kernel.org>, Shuah Khan <shuah@kernel.org>,
	Peter Seiderer <ps.report@gmx.net>,
	Fedor Pchelkin <pchelkin@ispras.ru>,
	Arnd Bergmann <arnd@arndb.de>, Nam Cao <namcao@linutronix.de>
Subject: [PATCH net-next v8 0/8] Some pktgen fixes/improvments (part II)
Date: Thu, 27 Feb 2025 14:55:56 +0100	[thread overview]
Message-ID: <20250227135604.40024-1-ps.report@gmx.net> (raw)

While taking a look at '[PATCH net] pktgen: Avoid out-of-range in
get_imix_entries' ([1]) and '[PATCH net v2] pktgen: Avoid out-of-bounds
access in get_imix_entries' ([2], [3]) and doing some tests and code review
I detected that the /proc/net/pktgen/... parsing logic does not honour the
user given buffer bounds (resulting in out-of-bounds access).

This can be observed e.g. by the following simple test (sometimes the
old/'longer' previous value is re-read from the buffer):

        $ echo add_device lo@0 > /proc/net/pktgen/kpktgend_0

        $ echo "min_pkt_size 12345" > /proc/net/pktgen/lo\@0 && grep min_pkt_size /proc/net/pktgen/lo\@0
Params: count 1000  min_pkt_size: 12345  max_pkt_size: 0
Result: OK: min_pkt_size=12345

        $ echo -n "min_pkt_size 123" > /proc/net/pktgen/lo\@0 && grep min_pkt_size /proc/net/pktgen/lo\@0
Params: count 1000  min_pkt_size: 12345  max_pkt_size: 0
Result: OK: min_pkt_size=12345

        $ echo "min_pkt_size 123" > /proc/net/pktgen/lo\@0 && grep min_pkt_size /proc/net/pktgen/lo\@0
Params: count 1000  min_pkt_size: 123  max_pkt_size: 0
Result: OK: min_pkt_size=123

So fix the out-of-bounds access (and some minor findings) and add a simple
proc_net_pktgen selftest...

Patch set splited into part I (now already applied to net-next)

- net: pktgen: replace ENOTSUPP with EOPNOTSUPP
- net: pktgen: enable 'param=value' parsing
- net: pktgen: fix hex32_arg parsing for short reads
- net: pktgen: fix 'rate 0' error handling (return -EINVAL)
- net: pktgen: fix 'ratep 0' error handling (return -EINVAL)
- net: pktgen: fix ctrl interface command parsing
- net: pktgen: fix access outside of user given buffer in pktgen_thread_write()

nd part II (this one):

- net: pktgen: use defines for the various dec/hex number parsing digits lengths
- net: pktgen: fix mix of int/long
- net: pktgen: remove extra tmp variable (re-use len instead)
- net: pktgen: remove some superfluous variable initializing
- net: pktgen: fix mpls maximum labels list parsing
- net: pktgen: fix access outside of user given buffer in pktgen_if_write()
- net: pktgen: fix mpls reset parsing
- net: pktgen: remove all superfluous index assignements
- selftest: net: add proc_net_pktgen

Regards,
Peter

Changes v7 -> v8:
 - rebased on actual net-next/main
 - add rev-by Simon Horman
 - net: pktgen: fix mpls maximum labels list parsing
  - slightly rephrase commit message, omit '/16' (suggested by Paolo Abeni)
 - net: pktgen: fix mpls reset parsing
  - fix c99 comment (suggested by Paolo Abeni)
 - selftest: net: add proc_net_pktgen
  - fix c99 comments (suggested by Paolo Abeni)

Changes v6 -> v7:
  - rebased on actual net-next/main
  - selftest: net: add proc_net_pktgen
    - fixed conflict in tools/testing/selftests/net/config

Changes v5 -> v6:
 - add rev-by Simon Horman
 - drop patch 'net: pktgen: use defines for the various dec/hex number
   parsing digits lengths'
 - adjust to dropped patch 'net: pktgen: use defines for the various
   dec/hex number parsing digits lengths'
 - net: pktgen: fix mix of int/long
   - fix line break (suggested by Simon Horman)

Changes v4 -> v5:
 - split up patchset into part i/ii (suggested by Simon Horman)
 - add rev-by Simon Horman
 - net: pktgen: align some variable  declarations to the most common pattern
   -> net: pktgen: fix mix of int/long
   - instead of align to most common pattern (int) adjust all usages to
      size_t for i and max and ssize_t for len and adjust function signatures
      of hex32_arg(), count_trail_chars(), num_arg() and strn_len() accordingly
   - respect reverse xmas tree order for local variable declarations (where
        possible without too much code churn)
   - update subject line and patch description
 - dropped net: pktgen: hex32_arg/num_arg error out in case no characters are
   available
   - keep empty hex/num arg is implicit assumed as zero value
 - dropped net: pktgen: num_arg error out in case no valid character is parsed
   - keep empty hex/num arg is implicit assumed as zero value
 - Change patch description ('Fixes:' -> 'Addresses the following:',
   suggested by Simon Horman)
 - net: pktgen: remove all superfluous index assignements
   - new patch (suggested by Simon Horman)
 - selftest: net: add proc_net_pktgen
   - addapt to dropped patch 'net: pktgen: hex32_arg/num_arg error out in case
     no characters are available', empty hex/num arg is now implicit assumed as
     zero value (instead of failure)

Changes v3 -> v4:
 - add rev-by Simon Horman
 - new patch 'net: pktgen: use defines for the various dec/hex number parsing
   digits lengths' (suggested by Simon Horman)
 - replace C99 comment (suggested by Paolo Abeni)
 - drop available characters check in strn_len() (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: align some variable declarations to the
   most common pattern' (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: remove extra tmp variable (re-use len
   instead)' (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: remove some superfluous variable
   initializing' (suggested by Paolo Abeni)
 - factored out patch 'net: pktgen: fix mpls maximum labels list parsing'
   (suggested by Paolo Abeni)
 - factored out 'net: pktgen: hex32_arg/num_arg error out in case no
   characters are available' (suggested by Paolo Abeni)
 - factored out 'net: pktgen: num_arg error out in case no valid character
   is parsed' (suggested by Paolo Abeni)

Changes v2 -> v3:
 - new patch: 'net: pktgen: fix ctrl interface command parsing'
 - new patch: 'net: pktgen: fix mpls reset parsing'
 - tools/testing/selftests/net/proc_net_pktgen.c:
   - fix typo in change description ('v1 -> v1' and tyop)
   - rename some vars to better match usage
     add_loopback_0 -> thr_cmd_add_loopback_0
     rm_loopback_0 -> thr_cmd_rm_loopback_0
     wrong_ctrl_cmd -> wrong_thr_cmd
     legacy_ctrl_cmd -> legacy_thr_cmd
     ctrl_fd -> thr_fd
   - add ctrl interface tests

Changes v1 -> v2:
 - new patch: 'net: pktgen: fix hex32_arg parsing for short reads'
 - new patch: 'net: pktgen: fix 'rate 0' error handling (return -EINVAL)'
 - new patch: 'net: pktgen: fix 'ratep 0' error handling (return -EINVAL)'
 - net/core/pktgen.c: additional fix get_imix_entries() and get_labels()
 - tools/testing/selftests/net/proc_net_pktgen.c:
   - fix typo not vs. nod (suggested by Jakub Kicinski)
   - fix misaligned line (suggested by Jakub Kicinski)
   - enable fomerly commented out CONFIG_XFRM dependent test (command spi),
     as CONFIG_XFRM is enabled via tools/testing/selftests/net/config
     CONFIG_XFRM_INTERFACE/CONFIG_XFRM_USER (suggestex by Jakub Kicinski)
   - add CONFIG_NET_PKTGEN=m to tools/testing/selftests/net/config
     (suggested by Jakub Kicinski)
   - add modprobe pktgen to FIXTURE_SETUP() (suggested by Jakub Kicinski)
   - fix some checkpatch warnings (Missing a blank line after declarations)
   - shrink line length by re-naming some variables (command -> cmd,
     device -> dev)
   - add 'rate 0' testcase
   - add 'ratep 0' testcase

[1] https://lore.kernel.org/netdev/20241006221221.3744995-1-artem.chernyshev@red-soft.ru/
[2] https://lore.kernel.org/netdev/20250109083039.14004-1-pchelkin@ispras.ru/
[3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=76201b5979768500bca362871db66d77cb4c225e


Peter Seiderer (8):
  net: pktgen: fix mix of int/long
  net: pktgen: remove extra tmp variable (re-use len instead)
  net: pktgen: remove some superfluous variable initializing
  net: pktgen: fix mpls maximum labels list parsing
  net: pktgen: fix access outside of user given buffer in
    pktgen_if_write()
  net: pktgen: fix mpls reset parsing
  net: pktgen: remove all superfluous index assignements
  selftest: net: add proc_net_pktgen

 net/core/pktgen.c                             | 288 ++++----
 tools/testing/selftests/net/Makefile          |   1 +
 tools/testing/selftests/net/config            |   1 +
 tools/testing/selftests/net/proc_net_pktgen.c | 646 ++++++++++++++++++
 4 files changed, 805 insertions(+), 131 deletions(-)
 create mode 100644 tools/testing/selftests/net/proc_net_pktgen.c

-- 
2.48.1


             reply	other threads:[~2025-02-27 13:56 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-27 13:55 Peter Seiderer [this message]
2025-02-27 13:55 ` [PATCH net-next v8 1/8] net: pktgen: fix mix of int/long Peter Seiderer
2025-02-27 13:55 ` [PATCH net-next v8 2/8] net: pktgen: remove extra tmp variable (re-use len instead) Peter Seiderer
2025-02-27 13:55 ` [PATCH net-next v8 3/8] net: pktgen: remove some superfluous variable initializing Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 4/8] net: pktgen: fix mpls maximum labels list parsing Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 5/8] net: pktgen: fix access outside of user given buffer in pktgen_if_write() Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 6/8] net: pktgen: fix mpls reset parsing Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 7/8] net: pktgen: remove all superfluous index assignements Peter Seiderer
2025-02-27 13:56 ` [PATCH net-next v8 8/8] selftest: net: add proc_net_pktgen Peter Seiderer
2025-03-04 10:20 ` [PATCH net-next v8 0/8] Some pktgen fixes/improvments (part II) patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250227135604.40024-1-ps.report@gmx.net \
    --to=ps.report@gmx.net \
    --cc=arnd@arndb.de \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=namcao@linutronix.de \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=pchelkin@ispras.ru \
    --cc=shuah@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).