mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/Documentation/bpf
History
Kees Cook 896880ff30 bpf: Replace bpf_lpm_trie_key 0-length array with flexible array 
Replace deprecated 0-length array in struct bpf_lpm_trie_key with
flexible array. Found with GCC 13:

../kernel/bpf/lpm_trie.c:207:51: warning: array subscript i is outside array bounds of 'const __u8[0]' {aka 'const unsigned char[]'} [-Warray-bounds=]
  207 |                                        *(__be16 *)&key->data[i]);
      |                                                   ^~~~~~~~~~~~~
../include/uapi/linux/swab.h:102:54: note: in definition of macro '__swab16'
  102 | #define __swab16(x) (__u16)__builtin_bswap16((__u16)(x))
      |                                                      ^
../include/linux/byteorder/generic.h:97:21: note: in expansion of macro '__be16_to_cpu'
   97 | #define be16_to_cpu __be16_to_cpu
      |                     ^~~~~~~~~~~~~
../kernel/bpf/lpm_trie.c:206:28: note: in expansion of macro 'be16_to_cpu'
  206 |                 u16 diff = be16_to_cpu(*(__be16 *)&node->data[i]
^
      |                            ^~~~~~~~~~~
In file included from ../include/linux/bpf.h:7:
../include/uapi/linux/bpf.h:82:17: note: while referencing 'data'
   82 |         __u8    data[0];        /* Arbitrary size */
      |                 ^~~~

And found at run-time under CONFIG_FORTIFY_SOURCE:

  UBSAN: array-index-out-of-bounds in kernel/bpf/lpm_trie.c:218:49
  index 0 is out of range for type '__u8 [*]'

Changing struct bpf_lpm_trie_key is difficult since has been used by
userspace. For example, in Cilium:

	struct egress_gw_policy_key {
	        struct bpf_lpm_trie_key lpm_key;
	        __u32 saddr;
	        __u32 daddr;
	};

While direct references to the "data" member haven't been found, there
are static initializers what include the final member. For example,
the "{}" here:

        struct egress_gw_policy_key in_key = {
                .lpm_key = { 32 + 24, {} },
                .saddr   = CLIENT_IP,
                .daddr   = EXTERNAL_SVC_IP & 0Xffffff,
        };

To avoid the build time and run time warnings seen with a 0-sized
trailing array for struct bpf_lpm_trie_key, introduce a new struct
that correctly uses a flexible array for the trailing bytes,
struct bpf_lpm_trie_key_u8. As part of this, include the "header"
portion (which is just the "prefixlen" member), so it can be used
by anything building a bpf_lpr_trie_key that has trailing members that
aren't a u8 flexible array (like the self-test[1]), which is named
struct bpf_lpm_trie_key_hdr.

Unfortunately, C++ refuses to parse the __struct_group() helper, so
it is not possible to define struct bpf_lpm_trie_key_hdr directly in
struct bpf_lpm_trie_key_u8, so we must open-code the union directly.

Adjust the kernel code to use struct bpf_lpm_trie_key_u8 through-out,
and for the selftest to use struct bpf_lpm_trie_key_hdr. Add a comment
to the UAPI header directing folks to the two new options.

Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Closes: https://paste.debian.net/hidden/ca500597/
Link: https://lore.kernel.org/all/202206281009.4332AA33@keescook/ [1]
Link: https://lore.kernel.org/bpf/20240222155612.it.533-kees@kernel.org
 		2024-02-29 22:52:43 +01:00
..
libbpf documentation/bpf: Document cgroup unix socket address hooks 2023-10-11 17:27:55 -07:00
standardization bpf, docs: specify which BPF_ABS and BPF_IND fields were zero 2024-02-22 09:11:49 -08:00
bpf_design_QA.rst docs/bpf: Add documentation for new instructions 2023-07-27 18:54:17 -07:00
bpf_devel_QA.rst bpf: Replace deprecated -target with --target= for Clang 2023-06-29 15:46:17 +02:00
bpf_iterators.rst bpf, docs: BPF Iterator Document 2023-06-22 19:44:22 +02:00
bpf_licensing.rst bpf: Document BPF licensing. 2021-09-22 23:13:13 +02:00
bpf_prog_run.rst Documentation/bpf: Add documentation for BPF_PROG_RUN 2022-03-09 14:19:22 -08:00
btf.rst docs: automarkup: linkify git revs 2023-11-17 13:13:24 -07:00
clang-notes.rst bpf, docs: Explain helper functions 2023-03-10 13:02:00 -08:00
classic_vs_extended.rst bpf, docs: Split the comparism to classic BPF from instruction-set.rst 2021-12-30 16:31:44 -08:00
cpumasks.rst bpf: Add bpf_cpumask_weight() kfunc 2023-12-09 21:37:33 -08:00
drgn.rst bpf: Document bpf_inspect drgn tool 2020-03-26 00:08:36 +01:00
faq.rst bpf, docs: Fix ordering of bpf documentation 2021-11-17 23:24:01 +01:00
fs_kfuncs.rst Documentation/bpf: Add documentation for filesystem kfuncs 2023-12-01 16:21:03 -08:00
graph_ds_impl.rst Documentation: Fix typos 2023-08-18 11:29:03 -06:00
helpers.rst bpf, docs: Fix ordering of bpf documentation 2021-11-17 23:24:01 +01:00
index.rst Documentation/bpf: Add documentation for filesystem kfuncs 2023-12-01 16:21:03 -08:00
kfuncs.rst bpf: treewide: Annotate BPF kfuncs in BTF 2024-01-31 20:40:56 -08:00
linux-notes.rst bpf, docs: Move linux-notes.rst to root bpf docs tree 2023-08-30 16:35:44 +02:00
llvm_reloc.rst docs/bpf: Fix "file doesn't exist" warnings in {llvm_reloc,btf}.rst 2023-09-01 15:56:48 +02:00
map_array.rst docs/bpf: Fix sphinx warnings in BPF map docs 2022-11-24 01:05:04 +01:00
map_bloom_filter.rst docs/bpf: Document BPF_MAP_TYPE_BLOOM_FILTER 2022-11-23 22:47:32 +01:00
map_cgroup_storage.rst Remove duplicate words inside documentation 2022-09-27 13:21:43 -06:00
map_cgrp_storage.rst docs/bpf: Add documentation for new cgroup local storage 2022-10-25 23:19:20 -07:00
map_cpumap.rst docs/bpf: Fix sphinx warnings for cpumap 2022-11-23 22:38:53 +01:00
map_devmap.rst docs/bpf: Fix sphinx warnings for devmap 2022-11-23 22:40:27 +01:00
map_hash.rst docs/bpf: Add LRU internals description and graph 2023-04-27 14:20:44 +02:00
map_lpm_trie.rst bpf: Replace bpf_lpm_trie_key 0-length array with flexible array 2024-02-29 22:52:43 +01:00
map_lru_hash_update.dot docs/bpf: Add LRU internals description and graph 2023-04-27 14:20:44 +02:00
map_of_maps.rst docs/bpf: Fix sphinx warnings in BPF map docs 2022-11-24 01:05:04 +01:00
map_queue_stack.rst docs/bpf: Fix sphinx warnings in BPF map docs 2022-11-24 01:05:04 +01:00
map_sk_storage.rst docs/bpf: Reword docs for BPF_MAP_TYPE_SK_STORAGE 2022-12-14 18:35:41 +01:00
map_sockmap.rst sock: Remove ->sendpage*() in favour of sendmsg(MSG_SPLICE_PAGES) 2023-06-24 15:50:13 -07:00
map_xskmap.rst Documentation: bpf: correct spelling 2023-01-28 12:22:20 -08:00
maps.rst bpf, docs: Fix final bpf docs build failure 2023-03-02 22:36:10 -08:00
other.rst bpf, documentation: Add graph documentation for non-owning refs 2023-02-13 19:40:53 -08:00
prog_cgroup_sockopt.rst bpf: Document EFAULT changes for sockopt 2023-05-13 16:55:46 -07:00
prog_cgroup_sysctl.rst bpf: Document BPF_PROG_TYPE_CGROUP_SYSCTL 2019-04-18 16:05:36 -07:00
prog_flow_dissector.rst docs/bpf: update out-of-date doc in BPF flow dissector 2023-09-13 14:22:57 -07:00
prog_lsm.rst lsm: move hook comments docs to security/security.c 2023-04-28 11:58:34 -04:00
prog_sk_lookup.rst bpf: sk_lookup: Add user documentation 2020-08-24 14:46:50 -07:00
programs.rst docs/bpf: Add table of BPF program types to libbpf docs 2022-11-23 13:31:20 -08:00
redirect.rst bpf, docs: DEVMAPs and XDP_REDIRECT 2022-11-18 23:16:31 +01:00
ringbuf.rst Documentation: bpf: correct spelling 2023-01-28 12:22:20 -08:00
s390.rst bpf: Add s390 testing documentation 2019-10-30 16:25:31 +01:00
syscall_api.rst bpf, docs: Fix ordering of bpf documentation 2021-11-17 23:24:01 +01:00
test_debug.rst bpf, docs: Fix ordering of bpf documentation 2021-11-17 23:24:01 +01:00
verifier.rst docs/bpf: Fix an incorrect statement in verifier.rst 2024-01-23 14:40:23 -08:00