linux-kernel - Re: [PATCH net] selftests/bpf: fix pointer arithmetic in test_xdp_do

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <327aafc5-2bea-4cc2-9ada-9320146b5e28@intel.com>
Date: Tue, 7 May 2024 10:47:03 +0200
From: Alexander Lobakin <aleksander.lobakin@...el.com>
To: Michal Schmidt <mschmidt@...hat.com>
CC: Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann
	<daniel@...earbox.net>, "David S. Miller" <davem@...emloft.net>, "Jakub
 Kicinski" <kuba@...nel.org>, Jesper Dangaard Brouer <hawk@...nel.org>, "John
 Fastabend" <john.fastabend@...il.com>, Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>, Eduard Zingerman
	<eddyz87@...il.com>, Song Liu <song@...nel.org>, Yonghong Song
	<yonghong.song@...ux.dev>, KP Singh <kpsingh@...nel.org>, Stanislav Fomichev
	<sdf@...gle.com>, Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
	Mykola Lysenko <mykolal@...com>, Shuah Khan <shuah@...nel.org>,
	Toke Høiland-Jørgensen <toke@...hat.com>,
	<netdev@...r.kernel.org>, <bpf@...r.kernel.org>,
	<linux-kselftest@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH net] selftests/bpf: fix pointer arithmetic in
 test_xdp_do_redirect

From: Michal Schmidt <mschmidt@...hat.com>
Date: Mon,  6 May 2024 16:50:22 +0200

> Cast operation has a higher precedence than addition. The code here
> wants to zero the 2nd half of the 64-bit metadata, but due to a pointer
> arithmetic mistake, it writes the zero at offset 16 instead.
> 
> Just adding parentheses around "data + 4" would fix this, but I think
> this will be slightly better readable with array syntax.
> 
> I was unable to test this with tools/testing/selftests/bpf/vmtest.sh,
> because my glibc is newer than glibc in the provided VM image.
> So I just checked the difference in the compiled code.
> objdump -S tools/testing/selftests/bpf/xdp_do_redirect.test.o:
>   -	*((__u32 *)data) = 0x42; /* metadata test value */
>   +	((__u32 *)data)[0] = 0x42; /* metadata test value */
>         be7:	48 8d 85 30 fc ff ff 	lea    -0x3d0(%rbp),%rax
>         bee:	c7 00 42 00 00 00    	movl   $0x42,(%rax)
>   -	*((__u32 *)data + 4) = 0;
>   +	((__u32 *)data)[1] = 0;
>         bf4:	48 8d 85 30 fc ff ff 	lea    -0x3d0(%rbp),%rax
>   -     bfb:	48 83 c0 10          	add    $0x10,%rax
>   +     bfb:	48 83 c0 04          	add    $0x4,%rax
>         bff:	c7 00 00 00 00 00    	movl   $0x0,(%rax)
> 
> Fixes: 5640b6d89434 ("selftests/bpf: fix "metadata marker" getting overwritten by the netstack")
> Signed-off-by: Michal Schmidt <mschmidt@...hat.com>
> ---
>  tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
> index 498d3bdaa4b0..bad0ea167be7 100644
> --- a/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
> +++ b/tools/testing/selftests/bpf/prog_tests/xdp_do_redirect.c
> @@ -107,8 +107,8 @@ void test_xdp_do_redirect(void)
>  			    .attach_point = BPF_TC_INGRESS);
>  
>  	memcpy(&data[sizeof(__u64)], &pkt_udp, sizeof(pkt_udp));
> -	*((__u32 *)data) = 0x42; /* metadata test value */
> -	*((__u32 *)data + 4) = 0;
> +	((__u32 *)data)[0] = 0x42; /* metadata test value */
> +	((__u32 *)data)[1] = 0;

Uff sorry. I was a bit in hurry to fix BPF CI and did this braino :z
I know pointer arithms obviously :D
I'd give a Rev-by, but it was applied already. Thanks!

>  
>  	skel = test_xdp_do_redirect__open();
>  	if (!ASSERT_OK_PTR(skel, "skel"))

Thanks,
Olek