linux-kernel - [PATCH] libbpf hashmap: Avoid undefined behavior in hash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201029220919.481279-1-irogers@google.com>
Date:   Thu, 29 Oct 2020 15:09:19 -0700
From:   Ian Rogers <irogers@...gle.com>
To:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>, netdev@...r.kernel.org,
        bpf@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     Ian Rogers <irogers@...gle.com>
Subject: [PATCH] libbpf hashmap: Avoid undefined behavior in hash_bits

If bits is 0, the case when the map is empty, then the >> is the size of
the register which is undefined behavior - on x86 it is the same as a
shift by 0.
Avoid calling hash_bits with bits == 0 by adding additional empty
hashmap tests.

Suggested-by: Andrii Nakryiko <andriin@...com>,
Suggested-by: Song Liu <songliubraving@...com>
Signed-off-by: Ian Rogers <irogers@...gle.com>
---
 tools/lib/bpf/hashmap.c | 12 ++++++++++--
 tools/lib/bpf/hashmap.h | 12 ++++++------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/tools/lib/bpf/hashmap.c b/tools/lib/bpf/hashmap.c
index 3c20b126d60d..41e6f636101e 100644
--- a/tools/lib/bpf/hashmap.c
+++ b/tools/lib/bpf/hashmap.c
@@ -156,7 +156,7 @@ int hashmap__insert(struct hashmap *map, const void *key, void *value,
 		    const void **old_key, void **old_value)
 {
 	struct hashmap_entry *entry;
-	size_t h;
+	size_t h = 0;
 	int err;
 
 	if (old_key)
@@ -164,7 +164,9 @@ int hashmap__insert(struct hashmap *map, const void *key, void *value,
 	if (old_value)
 		*old_value = NULL;
 
-	h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
+	if (map->buckets)
+		h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
+
 	if (strategy != HASHMAP_APPEND &&
 	    hashmap_find_entry(map, key, h, NULL, &entry)) {
 		if (old_key)
@@ -208,6 +210,9 @@ bool hashmap__find(const struct hashmap *map, const void *key, void **value)
 	struct hashmap_entry *entry;
 	size_t h;
 
+	if (!map->buckets)
+		return false;
+
 	h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
 	if (!hashmap_find_entry(map, key, h, NULL, &entry))
 		return false;
@@ -223,6 +228,9 @@ bool hashmap__delete(struct hashmap *map, const void *key,
 	struct hashmap_entry **pprev, *entry;
 	size_t h;
 
+	if (!map->buckets)
+		return false;
+
 	h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
 	if (!hashmap_find_entry(map, key, h, &pprev, &entry))
 		return false;
diff --git a/tools/lib/bpf/hashmap.h b/tools/lib/bpf/hashmap.h
index d9b385fe808c..61236437876e 100644
--- a/tools/lib/bpf/hashmap.h
+++ b/tools/lib/bpf/hashmap.h
@@ -174,17 +174,17 @@ bool hashmap__find(const struct hashmap *map, const void *key, void **value);
  * @key: key to iterate entries for
  */
 #define hashmap__for_each_key_entry(map, cur, _key)			    \
-	for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\
-					     map->cap_bits);		    \
-		     map->buckets ? map->buckets[bkt] : NULL; });	    \
+	for (cur = map->buckets						    \
+		     ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \
+		     : NULL;						    \
 	     cur;							    \
 	     cur = cur->next)						    \
 		if (map->equal_fn(cur->key, (_key), map->ctx))
 
 #define hashmap__for_each_key_entry_safe(map, cur, tmp, _key)		    \
-	for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\
-					     map->cap_bits);		    \
-		     cur = map->buckets ? map->buckets[bkt] : NULL; });	    \
+	for (cur = map->buckets						    \
+		     ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \
+		     : NULL;						    \
 	     cur && ({ tmp = cur->next; true; });			    \
 	     cur = tmp)							    \
 		if (map->equal_fn(cur->key, (_key), map->ctx))
-- 
2.29.1.341.ge80a0c044ae-goog