From patchwork Wed Oct 4 13:19:37 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Gustavo A. R. Silva" X-Patchwork-Id: 148307 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:254a:b0:403:3b70:6f57 with SMTP id hf10csp127823vqb; Wed, 4 Oct 2023 06:20:00 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGKWy8/55FsPm5zUEmYDGDjUAoybo5JO+wnJpbbXk11cjxPcG8i/UJ5CMf3h0KG4IO/Aes4 X-Received: by 2002:a05:6a00:198e:b0:690:d0d4:b757 with SMTP id d14-20020a056a00198e00b00690d0d4b757mr2386047pfl.20.1696425599829; Wed, 04 Oct 2023 06:19:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696425599; cv=none; d=google.com; s=arc-20160816; b=wotgqOeBuaXGjp3sLcKUeXr+y1LR4MP+hYMH3QE7UzdGOPtpH9XO4+K7tv/aHFDa5c STmOThW+nWseO1/rQoHqP5FWr2b0vZhWTVQcEl+caYDTZ/daTYlURRY6PZK60DQWV7s/ YLNrenH8umzXC6nNsmZfOPuaeDCkq4B45OjyOdUpyDMcAe1IYnLOS5WOTqTjmY0s7d3F ygkbayoepzZIDMCI836acQYN9RfX1518GIJlX++Wdy83CZMPeyqJKonFE//m/qfJoV/w /y+TtLga9MK8dc0nU1IJhglgT08wKZJuX8fY4A1ufCTrrTx8iqgB8AODbPdJ+7OwIWdv 8ipg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-disposition:mime-version:message-id :subject:cc:to:from:date:dkim-signature; bh=tBBlVSpWrpYwKtLmDUdb0InUKJn3C9k0wOiNWQ0jSEU=; fh=N5x1ljNvPZkPediS4bw9zEsFtqA5zOzprb3oJWT1J5c=; b=nDJ1qbYwnpFROz1ps4sVD1JYsfx4/w72dQOFjqYi6aENrrFSc27j8ELnbPfu/uvc5b Tv5Tajz8e+Jbxxe4NZBWo18u0B8JAEWXgjB/fr7ZiniUZ73naLPWVhjStwfqDQEugz/X 6BAoVL5QpWnCXhyjQewciib4MPLXbvPTtgn3BXGfFPCj9N/63obdJhfubv6UcY54oCzs TJoR0yzWwVLqaTUIREQMoKCWFBaNX8lFnvnHhkbJQ5vrFYU03Yms/2tXGmTDMumpndwe X7oinFiO3pkRBt62WSAe20A/l0KZpnPQtTp/Z9mXCtwwzgges3vDd+upxwmy16qA5B2q 1P9A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=eVTuL3ho; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from howler.vger.email (howler.vger.email. [2620:137:e000::3:4]) by mx.google.com with ESMTPS id s5-20020a056a00178500b0068e2f6feab4si3880459pfg.374.2023.10.04.06.19.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Oct 2023 06:19:59 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) client-ip=2620:137:e000::3:4; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=eVTuL3ho; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:4 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by howler.vger.email (Postfix) with ESMTP id 2E11A82FAF1E; Wed, 4 Oct 2023 06:19:59 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at howler.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242579AbjJDNTt (ORCPT + 18 others); Wed, 4 Oct 2023 09:19:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55718 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233096AbjJDNTr (ORCPT ); Wed, 4 Oct 2023 09:19:47 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A7E3298 for ; Wed, 4 Oct 2023 06:19:44 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39850C433C7; Wed, 4 Oct 2023 13:19:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1696425584; bh=bhclEsddtPiCxtYvFgBUs63/P/GoHLqamR5MHHrkOGs=; h=Date:From:To:Cc:Subject:From; b=eVTuL3hok71ptrABuk/GXY5dSnBMUIKIyxTpnstpH8KlEo3/1n+GA9pCZ+P8NioaB psPOxIbZ4ATGY7Rje6IKtCBcGebBP9mM1GJVfeEgXh2L3epgTG+wZAa5HF14Wh4VZV HMriNU1ynrdrLKC6RMJY8C3llX6ylefeuA0w03lNzJtERXE87MbWAz4NPMlrOURBqP 64Cu/tLWsjFM+6kC2Nber7j6EwoCpYrYdqCYTYp5cmWJSpn+fAi6vZT8KCxfGDD+gG PMH0Lkdi59RLj9f8MAJ9hx2l919azOpWDb4JNwBZ+WyVLihiNDpEWosfqgkY6f7SVd k0m7kvHd+8zLw== Date: Wed, 4 Oct 2023 15:19:37 +0200 From: "Gustavo A. R. Silva" To: Jamal Hadi Salim , Cong Wang , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , "Gustavo A. R. Silva" Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Gustavo A. R. Silva" , linux-hardening@vger.kernel.org, Kees Cook Subject: [PATCH v2] net: sched: cls_u32: Fix allocation size in u32_init() Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, RCVD_IN_DNSWL_BLOCKED,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Wed, 04 Oct 2023 06:19:59 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778831169740328803 X-GMAIL-MSGID: 1778831169740328803 commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array with flexible-array member") incorrecly replaced an instance of `sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results in a an over-allocation of 8 bytes. This change is wrong because `hlist` in `struct tc_u_common` is a pointer: net/sched/cls_u32.c: struct tc_u_common { struct tc_u_hnode __rcu *hlist; void *ptr; int refcnt; struct idr handle_idr; struct hlist_node hnode; long knodes; }; So, the use of `struct_size()` makes no sense: we don't need to allocate any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine. So, `struct_size(tp_c, hlist->ht, 1)` translates to: sizeof(*tp_c) + sizeof(tp_c->hlist->ht) == sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) == 144 + 8 == 0x98 (byes) ^^^ | unnecessary extra allocation size $ pahole -C tc_u_common net/sched/cls_u32.o struct tc_u_common { struct tc_u_hnode * hlist; /* 0 8 */ void * ptr; /* 8 8 */ int refcnt; /* 16 4 */ /* XXX 4 bytes hole, try to pack */ struct idr handle_idr; /* 24 96 */ /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */ struct hlist_node hnode; /* 120 16 */ /* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */ long int knodes; /* 136 8 */ /* size: 144, cachelines: 3, members: 6 */ /* sum members: 140, holes: 1, sum holes: 4 */ /* last cacheline: 16 bytes */ }; And with `sizeof(*tp_c)`, we have: sizeof(*tp_c) == sizeof(struct tc_u_common) == 144 == 0x90 (bytes) which is the correct and original allocation size. Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with `sizeof(*tp_c)`, and avoid allocating 8 too many bytes. The following difference in binary output is expected and reflects the desired change: | net/sched/cls_u32.o | @@ -6148,7 +6148,7 @@ | include/linux/slab.h:599 | 2cf5: mov 0x0(%rip),%rdi # 2cfc | 2cf8: R_X86_64_PC32 kmalloc_caches+0xc |- 2cfc: mov $0x98,%edx |+ 2cfc: mov $0x90,%edx Reported-by: Alejandro Colomar Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@kernel.org/ Signed-off-by: Gustavo A. R. Silva Acked-by: Jamal Hadi Salim --- Changes in v2: - Update subject line. - Update changelog text. v1: - Link: https://lore.kernel.org/linux-hardening/ZN5DvRyq6JNz20l1@work/ net/sched/cls_u32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index da4c179a4d41..6663e971a13e 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -366,7 +366,7 @@ static int u32_init(struct tcf_proto *tp) idr_init(&root_ht->handle_idr); if (tp_c == NULL) { - tp_c = kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL); + tp_c = kzalloc(sizeof(*tp_c), GFP_KERNEL); if (tp_c == NULL) { kfree(root_ht); return -ENOBUFS;