[PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()

[PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()

[Zijun Hu]

From: Zijun Hu <quic_zijuhu@quicinc.com>

assign|release_proto_idx() wrongly check find_first_zero_bit() failure
by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.

Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
Also check @->inuse_idx before accessing @->val[] to avoid OOB.

Fixes: 13ff3d6fa4e6 ("[SOCK]: Enumerate struct proto-s to facilitate percpu inuse accounting (v2).")
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
---
 include/net/sock.h | 5 ++++-
 net/core/sock.c    | 7 +++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/net/sock.h b/include/net/sock.h
index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1421,7 +1421,10 @@ struct prot_inuse {
 static inline void sock_prot_inuse_add(const struct net *net,
 				       const struct proto *prot, int val)
 {
-	this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
+	unsigned int idx = prot->inuse_idx;
+
+	if (likely(idx < PROTO_INUSE_NR))
+		this_cpu_add(net->core.prot_inuse->val[idx], val);
 }
 
 static inline void sock_inuse_add(const struct net *net, int val)
diff --git a/net/core/sock.c b/net/core/sock.c
index 323892066def8ba517ff59f98f2e4ab47edd4e63..92f4618c576a3120bcc8e9d03d36738b77447360 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3948,6 +3948,9 @@ int sock_prot_inuse_get(struct net *net, struct proto *prot)
 	int cpu, idx = prot->inuse_idx;
 	int res = 0;
 
+	if (unlikely(idx >= PROTO_INUSE_NR))
+		return 0;
+
 	for_each_possible_cpu(cpu)
 		res += per_cpu_ptr(net->core.prot_inuse, cpu)->val[idx];
 
@@ -3999,7 +4002,7 @@ static int assign_proto_idx(struct proto *prot)
 {
 	prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
 
-	if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
+	if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) {
 		pr_err("PROTO_INUSE_NR exhausted\n");
 		return -ENOSPC;
 	}
@@ -4010,7 +4013,7 @@ static int assign_proto_idx(struct proto *prot)
 
 static void release_proto_idx(struct proto *prot)
 {
-	if (prot->inuse_idx != PROTO_INUSE_NR - 1)
+	if (prot->inuse_idx != PROTO_INUSE_NR)
 		clear_bit(prot->inuse_idx, proto_inuse_idx);
 }
 #else

---
base-commit: 34a07c5b257453b5fcadc2408719c7b075844014
change-id: 20250405-fix_net-3e8364d302ff

Best regards,
-- 
Zijun Hu <quic_zijuhu@quicinc.com>

Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()

[Kuniyuki Iwashima]

From: Zijun Hu <zijun_hu@icloud.com>
Date: Tue, 08 Apr 2025 21:42:34 +0800
> From: Zijun Hu <quic_zijuhu@quicinc.com>
> 
> assign|release_proto_idx() wrongly check find_first_zero_bit() failure
> by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
> 
> Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
> Also check @->inuse_idx before accessing @->val[] to avoid OOB.
> 
> Fixes: 13ff3d6fa4e6 ("[SOCK]: Enumerate struct proto-s to facilitate percpu inuse accounting (v2).")
> Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
> ---
>  include/net/sock.h | 5 ++++-
>  net/core/sock.c    | 7 +++++--
>  2 files changed, 9 insertions(+), 3 deletions(-)
> 
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -1421,7 +1421,10 @@ struct prot_inuse {
>  static inline void sock_prot_inuse_add(const struct net *net,
>  				       const struct proto *prot, int val)
>  {
> -	this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
> +	unsigned int idx = prot->inuse_idx;
> +
> +	if (likely(idx < PROTO_INUSE_NR))
> +		this_cpu_add(net->core.prot_inuse->val[idx], val);

How does the else case happen ?


>  }
>  
>  static inline void sock_inuse_add(const struct net *net, int val)
> diff --git a/net/core/sock.c b/net/core/sock.c
> index 323892066def8ba517ff59f98f2e4ab47edd4e63..92f4618c576a3120bcc8e9d03d36738b77447360 100644
> --- a/net/core/sock.c
> +++ b/net/core/sock.c
> @@ -3948,6 +3948,9 @@ int sock_prot_inuse_get(struct net *net, struct proto *prot)
>  	int cpu, idx = prot->inuse_idx;
>  	int res = 0;
>  
> +	if (unlikely(idx >= PROTO_INUSE_NR))

Same here.


> +		return 0;
> +
>  	for_each_possible_cpu(cpu)
>  		res += per_cpu_ptr(net->core.prot_inuse, cpu)->val[idx];
>  
> @@ -3999,7 +4002,7 @@ static int assign_proto_idx(struct proto *prot)
>  {
>  	prot->inuse_idx = find_first_zero_bit(proto_inuse_idx, PROTO_INUSE_NR);
>  
> -	if (unlikely(prot->inuse_idx == PROTO_INUSE_NR - 1)) {
> +	if (unlikely(prot->inuse_idx == PROTO_INUSE_NR)) {
>  		pr_err("PROTO_INUSE_NR exhausted\n");
>  		return -ENOSPC;
>  	}
> @@ -4010,7 +4013,7 @@ static int assign_proto_idx(struct proto *prot)
>  
>  static void release_proto_idx(struct proto *prot)
>  {
> -	if (prot->inuse_idx != PROTO_INUSE_NR - 1)
> +	if (prot->inuse_idx != PROTO_INUSE_NR)
>  		clear_bit(prot->inuse_idx, proto_inuse_idx);
>  }
>  #else
> 
> ---
> base-commit: 34a07c5b257453b5fcadc2408719c7b075844014
> change-id: 20250405-fix_net-3e8364d302ff
> 
> Best regards,
> -- 
> Zijun Hu <quic_zijuhu@quicinc.com>

Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()

[Eric Dumazet]

On Tue, Apr 8, 2025 at 3:43 PM Zijun Hu <zijun_hu@icloud.com> wrote:
>
> From: Zijun Hu <quic_zijuhu@quicinc.com>
>
> assign|release_proto_idx() wrongly check find_first_zero_bit() failure
> by condition '(prot->inuse_idx == PROTO_INUSE_NR - 1)' obviously.
>
> Fix by correcting the condition to '(prot->inuse_idx == PROTO_INUSE_NR)'
> Also check @->inuse_idx before accessing @->val[] to avoid OOB.
>
> Fixes: 13ff3d6fa4e6 ("[SOCK]: Enumerate struct proto-s to facilitate percpu inuse accounting (v2).")
> Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
> ---
>  include/net/sock.h | 5 ++++-
>  net/core/sock.c    | 7 +++++--
>  2 files changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/sock.h b/include/net/sock.h
> index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -1421,7 +1421,10 @@ struct prot_inuse {
>  static inline void sock_prot_inuse_add(const struct net *net,
>                                        const struct proto *prot, int val)
>  {
> -       this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
> +       unsigned int idx = prot->inuse_idx;
> +
> +       if (likely(idx < PROTO_INUSE_NR))
> +               this_cpu_add(net->core.prot_inuse->val[idx], val);
>  }

I do not think we are going to add such a test in the fast path, for a
bug that can not happen.

Please give us a reproducer ?

Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()

[Zijun Hu]

On 2025/4/9 02:21, Kuniyuki Iwashima wrote:
>> diff --git a/include/net/sock.h b/include/net/sock.h
>> index 8daf1b3b12c607d81920682139b53fee935c9bb5..9ece93a3dd044997276b0fa37dddc7b5bbdacc43 100644
>> --- a/include/net/sock.h
>> +++ b/include/net/sock.h
>> @@ -1421,7 +1421,10 @@ struct prot_inuse {
>>  static inline void sock_prot_inuse_add(const struct net *net,
>>  				       const struct proto *prot, int val)
>>  {
>> -	this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
>> +	unsigned int idx = prot->inuse_idx;
>> +
>> +	if (likely(idx < PROTO_INUSE_NR))
>> +		this_cpu_add(net->core.prot_inuse->val[idx], val);
> How does the else case happen ?

thank you for code review.

provided that @prot->inuse_idx will never be used if @prot fails to be
registered.

will remove this check in v2.

Re: [PATCH net-next] sock: Correct error checking condition for assign|release_proto_idx()

[Zijun Hu]

On 2025/4/9 03:06, Eric Dumazet wrote:
>>  {
>> -       this_cpu_add(net->core.prot_inuse->val[prot->inuse_idx], val);
>> +       unsigned int idx = prot->inuse_idx;
>> +
>> +       if (likely(idx < PROTO_INUSE_NR))
>> +               this_cpu_add(net->core.prot_inuse->val[idx], val);
>>  }
> I do not think we are going to add such a test in the fast path, for a
> bug that can not happen.
> 

agree.

> Please give us a reproducer ?

will remove that check in v2 provided @prot->inuse_idx will never be
used if @prot fails to be registered.

thank you for code review.