linux-hardening - Re: [PATCH] RDMA/mana_ib: Add flex array to struct mana_cfg_rx_steer_req

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1be10e9c-e521-4974-b2ed-808a2e3a1a9d@embeddedor.com>
Date: Sun, 31 Mar 2024 20:53:07 -0600
From: "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To: Erick Archer <erick.archer@...look.com>, Long Li <longli@...rosoft.com>,
 Ajay Sharma <sharmaajay@...rosoft.com>, Jason Gunthorpe <jgg@...pe.ca>,
 Leon Romanovsky <leon@...nel.org>, "K. Y. Srinivasan" <kys@...rosoft.com>,
 Haiyang Zhang <haiyangz@...rosoft.com>, Wei Liu <wei.liu@...nel.org>,
 Dexuan Cui <decui@...rosoft.com>, "David S. Miller" <davem@...emloft.net>,
 Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>,
 Shradha Gupta <shradhagupta@...ux.microsoft.com>,
 Konstantin Taranov <kotaranov@...rosoft.com>,
 Kees Cook <keescook@...omium.org>,
 "Gustavo A. R. Silva" <gustavoars@...nel.org>
Cc: linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org,
 linux-hyperv@...r.kernel.org, netdev@...r.kernel.org,
 linux-hardening@...r.kernel.org
Subject: Re: [PATCH] RDMA/mana_ib: Add flex array to struct
 mana_cfg_rx_steer_req_v2



On 31/03/24 09:04, Erick Archer wrote:
> The "struct mana_cfg_rx_steer_req_v2" uses a dynamically sized set of
> trailing elements. Specifically, it uses a "mana_handle_t" array. So,
> use the preferred way in the kernel declaring a flexible array [1].
> 
> Also, avoid the open-coded arithmetic in the memory allocator functions
> [2] using the "struct_size" macro.
> 
> Moreover, use the "offsetof" helper to get the indirect table offset
> instead of the "sizeof" operator and avoid the open-coded arithmetic in
> pointers using the new flex member.
> 
> Now, it is also possible to use the "flex_array_size" helper to compute
> the size of these trailing elements in the "memcpy" function.
> 
> Link: https://www.kernel.org/doc/html/next/process/deprecated.html#zero-length-and-one-element-arrays [1]
> Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [2]
> Signed-off-by: Erick Archer <erick.archer@...look.com>
> ---
>   drivers/infiniband/hw/mana/qp.c               | 8 ++++----
>   drivers/net/ethernet/microsoft/mana/mana_en.c | 9 +++++----
>   include/net/mana/mana.h                       | 1 +
>   3 files changed, 10 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
> index 6e7627745c95..c2a39db8ef92 100644
> --- a/drivers/infiniband/hw/mana/qp.c
> +++ b/drivers/infiniband/hw/mana/qp.c
> @@ -22,8 +22,7 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
>   
>   	gc = mdev_to_gc(dev);
>   
> -	req_buf_size =
> -		sizeof(*req) + sizeof(mana_handle_t) * MANA_INDIRECT_TABLE_SIZE;
> +	req_buf_size = struct_size(req, indir_tab, MANA_INDIRECT_TABLE_SIZE);
>   	req = kzalloc(req_buf_size, GFP_KERNEL);
>   	if (!req)
>   		return -ENOMEM;
> @@ -44,11 +43,12 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
>   		req->rss_enable = true;
>   
>   	req->num_indir_entries = MANA_INDIRECT_TABLE_SIZE;
> -	req->indir_tab_offset = sizeof(*req);
> +	req->indir_tab_offset = offsetof(struct mana_cfg_rx_steer_req_v2,
> +					 indir_tab);
>   	req->update_indir_tab = true;
>   	req->cqe_coalescing_enable = 1;
>   
> -	req_indir_tab = (mana_handle_t *)(req + 1);
> +	req_indir_tab = req->indir_tab;

It seems that `req_indir_tab` can be removed, and `req->indir_tab` be directly used.

>   	/* The ind table passed to the hardware must have
>   	 * MANA_INDIRECT_TABLE_SIZE entries. Adjust the verb
>   	 * ind_table to MANA_INDIRECT_TABLE_SIZE if required
> diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
> index 59287c6e6cee..04aa096c6cc4 100644
> --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
> @@ -1062,7 +1062,7 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
>   	u32 req_buf_size;
>   	int err;
>   
> -	req_buf_size = sizeof(*req) + sizeof(mana_handle_t) * num_entries;
> +	req_buf_size = struct_size(req, indir_tab, num_entries);
>   	req = kzalloc(req_buf_size, GFP_KERNEL);
>   	if (!req)
>   		return -ENOMEM;
> @@ -1074,7 +1074,8 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
>   
>   	req->vport = apc->port_handle;
>   	req->num_indir_entries = num_entries;
> -	req->indir_tab_offset = sizeof(*req);
> +	req->indir_tab_offset = offsetof(struct mana_cfg_rx_steer_req_v2,
> +					 indir_tab);
>   	req->rx_enable = rx;
>   	req->rss_enable = apc->rss_state;
>   	req->update_default_rxobj = update_default_rxobj;
> @@ -1087,9 +1088,9 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
>   		memcpy(&req->hashkey, apc->hashkey, MANA_HASH_KEY_SIZE);
>   
>   	if (update_tab) {
> -		req_indir_tab = (mana_handle_t *)(req + 1);
> +		req_indir_tab = req->indir_tab;

Ditto.

Thanks
--
Gustavo

>   		memcpy(req_indir_tab, apc->rxobj_table,
> -		       req->num_indir_entries * sizeof(mana_handle_t));
> +		       flex_array_size(req, indir_tab, req->num_indir_entries));
>   	}
>   
>   	err = mana_send_request(apc->ac, req, req_buf_size, &resp,
> diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h
> index 76147feb0d10..20ffcae29e1e 100644
> --- a/include/net/mana/mana.h
> +++ b/include/net/mana/mana.h
> @@ -671,6 +671,7 @@ struct mana_cfg_rx_steer_req_v2 {
>   	u8 hashkey[MANA_HASH_KEY_SIZE];
>   	u8 cqe_coalescing_enable;
>   	u8 reserved2[7];
> +	mana_handle_t indir_tab[];
>   }; /* HW DATA */
>   
>   struct mana_cfg_rx_steer_resp {