linux-kernel - Re: [PATCH] net/mlx4_core: Avoid impossible mlx4_db

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFhGd8om_1W7inq+V4a4EP3e5y1y+qw7C3wi3DR4WpspYzZenQ@mail.gmail.com>
Date: Wed, 12 Feb 2025 16:10:40 -0800
From: Justin Stitt <justinstitt@...gle.com>
To: Tariq Toukan <ttoukan.linux@...il.com>
Cc: Kees Cook <kees@...nel.org>, Tariq Toukan <tariqt@...dia.com>, 
	Andrew Lunn <andrew+netdev@...n.ch>, "David S. Miller" <davem@...emloft.net>, 
	Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
	Yishai Hadas <yishaih@...dia.com>, netdev@...r.kernel.org, linux-rdma@...r.kernel.org, 
	linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH] net/mlx4_core: Avoid impossible mlx4_db_alloc() order value

On Tue, Feb 11, 2025 at 6:22 AM Tariq Toukan <ttoukan.linux@...il.com> wrote:
>
>
>
> On 11/02/2025 2:01, Justin Stitt wrote:
> > On Mon, Feb 10, 2025 at 09:45:05AM -0800, Kees Cook wrote:
> >> GCC can see that the value range for "order" is capped, but this leads
> >> it to consider that it might be negative, leading to a false positive
> >> warning (with GCC 15 with -Warray-bounds -fdiagnostics-details):
> >>
> >> ../drivers/net/ethernet/mellanox/mlx4/alloc.c:691:47: error: array subscript -1 is below array bounds of 'long unsigned int *[2]' [-Werror=array-bounds=]
> >>    691 |                 i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);
> >>        |                                    ~~~~~~~~~~~^~~
> >>    'mlx4_alloc_db_from_pgdir': events 1-2
> >>    691 |                 i = find_first_bit(pgdir->bits[o], MLX4_DB_PER_PAGE >> o);                        |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >>        |                     |                         |                                                   |                     |                         (2) out of array bounds here
> >>        |                     (1) when the condition is evaluated to true                             In file included from ../drivers/net/ethernet/mellanox/mlx4/mlx4.h:53,
> >>                   from ../drivers/net/ethernet/mellanox/mlx4/alloc.c:42:
> >> ../include/linux/mlx4/device.h:664:33: note: while referencing 'bits'
> >>    664 |         unsigned long          *bits[2];
> >>        |                                 ^~~~
> >>
> >> Switch the argument to unsigned int, which removes the compiler needing
> >> to consider negative values.
> >>
> >> Signed-off-by: Kees Cook <kees@...nel.org>
> >> ---
> >> Cc: Tariq Toukan <tariqt@...dia.com>
> >> Cc: Andrew Lunn <andrew+netdev@...n.ch>
> >> Cc: "David S. Miller" <davem@...emloft.net>
> >> Cc: Eric Dumazet <edumazet@...gle.com>
> >> Cc: Jakub Kicinski <kuba@...nel.org>
> >> Cc: Paolo Abeni <pabeni@...hat.com>
> >> Cc: Yishai Hadas <yishaih@...dia.com>
> >> Cc: netdev@...r.kernel.org
> >> Cc: linux-rdma@...r.kernel.org
> >> ---
> >>   drivers/net/ethernet/mellanox/mlx4/alloc.c | 6 +++---
> >>   include/linux/mlx4/device.h                | 2 +-
> >>   2 files changed, 4 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
> >> index b330020dc0d6..f2bded847e61 100644
> >> --- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
> >> +++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
> >> @@ -682,9 +682,9 @@ static struct mlx4_db_pgdir *mlx4_alloc_db_pgdir(struct device *dma_device)
> >>   }
> >>
> >>   static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
> >> -                                struct mlx4_db *db, int order)
> >> +                                struct mlx4_db *db, unsigned int order)
> >>   {
> >> -    int o;
> >> +    unsigned int o;
> >>      int i;
> >>
> >>      for (o = order; o <= 1; ++o) {
> >
> >    ^ Knowing now that @order can only be 0 or 1 can this for loop (and
> >    goto) be dropped entirely?
> >
>
> Maybe I'm missing something...
> Can you please explain why you think this can be dropped?

I meant "rewritten to use two if statements" instead of "dropped". I
think "replaced" or "refactored" was the word I wanted.

>
>
> >    The code is already short and sweet so I don't feel strongly either
> >    way.
> >
> >> @@ -712,7 +712,7 @@ static int mlx4_alloc_db_from_pgdir(struct mlx4_db_pgdir *pgdir,
> >>      return 0;
> >>   }
> >>
> >> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order)
> >> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order)
> >>   {
> >>      struct mlx4_priv *priv = mlx4_priv(dev);
> >>      struct mlx4_db_pgdir *pgdir;
> >> diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h
> >> index 27f42f713c89..86f0f2a25a3d 100644
> >> --- a/include/linux/mlx4/device.h
> >> +++ b/include/linux/mlx4/device.h
> >> @@ -1135,7 +1135,7 @@ int mlx4_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
> >>   int mlx4_buf_write_mtt(struct mlx4_dev *dev, struct mlx4_mtt *mtt,
> >>                     struct mlx4_buf *buf);
> >>
> >> -int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, int order);
> >> +int mlx4_db_alloc(struct mlx4_dev *dev, struct mlx4_db *db, unsigned int order);
> >>   void mlx4_db_free(struct mlx4_dev *dev, struct mlx4_db *db);
> >>
> >>   int mlx4_alloc_hwq_res(struct mlx4_dev *dev, struct mlx4_hwq_resources *wqres,
> >> --
> >> 2.34.1
> >>
> >
> > Justin
> >
>