linux-kernel - Re: [PATCH bpf-next] bpf: use type_may_be_null() helper for nullable-param check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZtllCZOrO9b-MDtE@google.com>
Date: Thu, 5 Sep 2024 08:00:09 +0000
From: Matt Bobrowski <mattbobrowski@...gle.com>
To: Shung-Hsi Yu <shung-hsi.yu@...e.com>
Cc: Eduard Zingerman <eddyz87@...il.com>, bpf@...r.kernel.org,
	Alexei Starovoitov <ast@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	Andrii Nakryiko <andrii@...nel.org>,
	Martin KaFai Lau <martin.lau@...ux.dev>, Song Liu <song@...nel.org>,
	Yonghong Song <yonghong.song@...ux.dev>,
	John Fastabend <john.fastabend@...il.com>,
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>,
	Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	David Vernet <void@...ifault.com>, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org, kernel test robot <lkp@...el.com>
Subject: Re: [PATCH bpf-next] bpf: use type_may_be_null() helper for
 nullable-param check

On Thu, Sep 05, 2024 at 01:52:32PM +0800, Shung-Hsi Yu wrote:
> Commit 980ca8ceeae6 ("bpf: check bpf_dummy_struct_ops program params for
> test runs") does bitwise AND between reg_type and PTR_MAYBE_NULL, which
> is correct, but due to type difference the compiler complains:
> 
>   net/bpf/bpf_dummy_struct_ops.c:118:31: warning: bitwise operation between different enumeration types ('const enum bpf_reg_type' and 'enum bpf_type_flag') [-Wenum-enum-conversion]
>     118 |                 if (info && (info->reg_type & PTR_MAYBE_NULL))
>         |                              ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~
> 
> Workaround the warning by moving the type_may_be_null() helper from
> verifier.c into bpf_verifier.h, and reuse it here to check whether param
> is nullable.
> 
> Fixes: 980ca8ceeae6 ("bpf: check bpf_dummy_struct_ops program params for test runs")
> Reported-by: kernel test robot <lkp@...el.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202404241956.HEiRYwWq-lkp@intel.com/
> Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@...e.com>
> ---
> Due to kernel test bot not setting the correct email header
> (reported[1]) Eduard probably never saw the report about the warning
> (nor did it show up on Patchwork).
> 
> 1: https://github.com/intel/lkp-tests/issues/383
> ---
>  include/linux/bpf_verifier.h   | 5 +++++
>  kernel/bpf/verifier.c          | 5 -----
>  net/bpf/bpf_dummy_struct_ops.c | 2 +-
>  3 files changed, 6 insertions(+), 6 deletions(-)
> 
> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> index 8458632824a4..4513372c5bc8 100644
> --- a/include/linux/bpf_verifier.h
> +++ b/include/linux/bpf_verifier.h
> @@ -927,6 +927,11 @@ static inline bool type_is_sk_pointer(enum bpf_reg_type type)
>  		type == PTR_TO_XDP_SOCK;
>  }
>  
> +static inline bool type_may_be_null(u32 type)
> +{
> +	return type & PTR_MAYBE_NULL;
> +}
> +
>
>  static inline void mark_reg_scratched(struct bpf_verifier_env *env, u32 regno)
>  {
>  	env->scratched_regs |= 1U << regno;
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index b806afeba212..53d0556fbbf3 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -383,11 +383,6 @@ static void verbose_invalid_scalar(struct bpf_verifier_env *env,
>  	verbose(env, " should have been in [%d, %d]\n", range.minval, range.maxval);
>  }
>  
> -static bool type_may_be_null(u32 type)
> -{
> -	return type & PTR_MAYBE_NULL;
> -}
> -
>  static bool reg_not_null(const struct bpf_reg_state *reg)
>  {
>  	enum bpf_reg_type type;
> diff --git a/net/bpf/bpf_dummy_struct_ops.c b/net/bpf/bpf_dummy_struct_ops.c
> index 3ea52b05adfb..f71f67c6896b 100644
> --- a/net/bpf/bpf_dummy_struct_ops.c
> +++ b/net/bpf/bpf_dummy_struct_ops.c
> @@ -115,7 +115,7 @@ static int check_test_run_args(struct bpf_prog *prog, struct bpf_dummy_ops_test_
>  
>  		offset = btf_ctx_arg_offset(bpf_dummy_ops_btf, func_proto, arg_no);
>  		info = find_ctx_arg_info(prog->aux, offset);
> -		if (info && (info->reg_type & PTR_MAYBE_NULL))
> +		if (info && type_may_be_null(info->reg_type))

Maybe as part of this clean up, we should also consider replacing all
the open-coded & PTR_MAYBE_NULL checks with type_may_be_null() which
we have sprinkled throughout kernel/bpf/verifier.c?

/M