netdev - Re: [PATCH net-next v5 05/15] net-timestamp: add strict check in some BPF calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202501171802.CSquHTL3-lkp@intel.com>
Date: Fri, 17 Jan 2025 18:18:51 +0800
From: kernel test robot <lkp@...el.com>
To: Jason Xing <kerneljasonxing@...il.com>, davem@...emloft.net,
	edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com,
	dsahern@...nel.org, willemdebruijn.kernel@...il.com,
	willemb@...gle.com, ast@...nel.org, daniel@...earbox.net,
	andrii@...nel.org, martin.lau@...ux.dev, eddyz87@...il.com,
	song@...nel.org, yonghong.song@...ux.dev, john.fastabend@...il.com,
	kpsingh@...nel.org, sdf@...ichev.me, haoluo@...gle.com,
	jolsa@...nel.org, horms@...nel.org
Cc: oe-kbuild-all@...ts.linux.dev, bpf@...r.kernel.org,
	netdev@...r.kernel.org, Jason Xing <kerneljasonxing@...il.com>
Subject: Re: [PATCH net-next v5 05/15] net-timestamp: add strict check in
 some BPF calls

Hi Jason,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]

url:    https://github.com/intel-lab-lkp/linux/commits/Jason-Xing/net-timestamp-add-support-for-bpf_setsockopt/20250112-194115
base:   net-next/main
patch link:    https://lore.kernel.org/r/20250112113748.73504-6-kerneljasonxing%40gmail.com
patch subject: [PATCH net-next v5 05/15] net-timestamp: add strict check in some BPF calls
config: arm-randconfig-r071-20250117 (https://download.01.org/0day-ci/archive/20250117/202501171802.CSquHTL3-lkp@intel.com/config)
compiler: arm-linux-gnueabi-gcc (GCC) 14.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202501171802.CSquHTL3-lkp@intel.com/

smatch warnings:
net/core/filter.c:7631 ____bpf_sock_ops_load_hdr_opt() warn: always true condition '(bpf_sock->op != 1009) => (0-255 != 1009)'

vim +7631 net/core/filter.c

  7622	
  7623	BPF_CALL_4(bpf_sock_ops_load_hdr_opt, struct bpf_sock_ops_kern *, bpf_sock,
  7624		   void *, search_res, u32, len, u64, flags)
  7625	{
  7626		bool eol, load_syn = flags & BPF_LOAD_HDR_OPT_TCP_SYN;
  7627		const u8 *op, *opend, *magic, *search = search_res;
  7628		u8 search_kind, search_len, copy_len, magic_len;
  7629		int ret;
  7630	
> 7631		if (bpf_sock->op != SK_BPF_CB_FLAGS)
  7632			return -EINVAL;
  7633	
  7634		/* 2 byte is the minimal option len except TCPOPT_NOP and
  7635		 * TCPOPT_EOL which are useless for the bpf prog to learn
  7636		 * and this helper disallow loading them also.
  7637		 */
  7638		if (len < 2 || flags & ~BPF_LOAD_HDR_OPT_TCP_SYN)
  7639			return -EINVAL;
  7640	
  7641		search_kind = search[0];
  7642		search_len = search[1];
  7643	
  7644		if (search_len > len || search_kind == TCPOPT_NOP ||
  7645		    search_kind == TCPOPT_EOL)
  7646			return -EINVAL;
  7647	
  7648		if (search_kind == TCPOPT_EXP || search_kind == 253) {
  7649			/* 16 or 32 bit magic.  +2 for kind and kind length */
  7650			if (search_len != 4 && search_len != 6)
  7651				return -EINVAL;
  7652			magic = &search[2];
  7653			magic_len = search_len - 2;
  7654		} else {
  7655			if (search_len)
  7656				return -EINVAL;
  7657			magic = NULL;
  7658			magic_len = 0;
  7659		}
  7660	
  7661		if (load_syn) {
  7662			ret = bpf_sock_ops_get_syn(bpf_sock, TCP_BPF_SYN, &op);
  7663			if (ret < 0)
  7664				return ret;
  7665	
  7666			opend = op + ret;
  7667			op += sizeof(struct tcphdr);
  7668		} else {
  7669			if (!bpf_sock->skb ||
  7670			    bpf_sock->op == BPF_SOCK_OPS_HDR_OPT_LEN_CB)
  7671				/* This bpf_sock->op cannot call this helper */
  7672				return -EPERM;
  7673	
  7674			opend = bpf_sock->skb_data_end;
  7675			op = bpf_sock->skb->data + sizeof(struct tcphdr);
  7676		}
  7677	
  7678		op = bpf_search_tcp_opt(op, opend, search_kind, magic, magic_len,
  7679					&eol);
  7680		if (IS_ERR(op))
  7681			return PTR_ERR(op);
  7682	
  7683		copy_len = op[1];
  7684		ret = copy_len;
  7685		if (copy_len > len) {
  7686			ret = -ENOSPC;
  7687			copy_len = len;
  7688		}
  7689	
  7690		memcpy(search_res, op, copy_len);
  7691		return ret;
  7692	}
  7693	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki