diff mbox series

[v2,net] bitfield.h: don't compile-time validate _val in FIELD_FIT

Message ID 20200810182112.2221964-1-ndesaulniers@google.com
State Superseded
Headers show
Series [v2,net] bitfield.h: don't compile-time validate _val in FIELD_FIT | expand

Commit Message

Nick Desaulniers Aug. 10, 2020, 6:21 p.m. UTC
From: Jakub Kicinski <kuba@kernel.org>


When ur_load_imm_any() is inlined into jeq_imm(), it's possible for the
compiler to deduce a case where _val can only have the value of -1 at
compile time. Specifically,

/* struct bpf_insn: _s32 imm */
u64 imm = insn->imm; /* sign extend */
if (imm >> 32) { /* non-zero only if insn->imm is negative */
  /* inlined from ur_load_imm_any */
  u32 __imm = imm >> 32; /* therefore, always 0xffffffff */
  if (__builtin_constant_p(__imm) && __imm > 255)
    compiletime_assert_XXX()

This can result in tripping a BUILD_BUG_ON() in __BF_FIELD_CHECK() that
checks that a given value is representable in one byte (interpreted as
unsigned).

FIELD_FIT() should return true or false at runtime for whether a value
can fit for not. Don't break the build over a value that's too large for
the mask. We'd prefer to keep the inlining and compiler optimizations
though we know this case will always return false.

Cc: stable@vger.kernel.org
Fixes: 1697599ee301a ("bitfield.h: add FIELD_FIT() helper")
Link: https://lore.kernel.org/kernel-hardening/CAK7LNASvb0UDJ0U5wkYYRzTAdnEs64HjXpEUL7d=V0CXiAXcNw@mail.gmail.com/
Reported-by: Masahiro Yamada <masahiroy@kernel.org>
Debugged-by: Sami Tolvanen <samitolvanen@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>

---
Changes V1->V2:
* add Fixes tag.

 include/linux/bitfield.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.28.0.236.gb10cc79966-goog

Comments

David Miller Aug. 10, 2020, 7:17 p.m. UTC | #1
From: Nick Desaulniers <ndesaulniers@google.com>

Date: Mon, 10 Aug 2020 11:21:11 -0700

> From: Jakub Kicinski <kuba@kernel.org>

> 

> When ur_load_imm_any() is inlined into jeq_imm(), it's possible for the

> compiler to deduce a case where _val can only have the value of -1 at

> compile time. Specifically,

> 

> /* struct bpf_insn: _s32 imm */

> u64 imm = insn->imm; /* sign extend */

> if (imm >> 32) { /* non-zero only if insn->imm is negative */

>   /* inlined from ur_load_imm_any */

>   u32 __imm = imm >> 32; /* therefore, always 0xffffffff */

>   if (__builtin_constant_p(__imm) && __imm > 255)

>     compiletime_assert_XXX()

> 

> This can result in tripping a BUILD_BUG_ON() in __BF_FIELD_CHECK() that

> checks that a given value is representable in one byte (interpreted as

> unsigned).

> 

> FIELD_FIT() should return true or false at runtime for whether a value

> can fit for not. Don't break the build over a value that's too large for

> the mask. We'd prefer to keep the inlining and compiler optimizations

> though we know this case will always return false.

> 

> Cc: stable@vger.kernel.org

> Fixes: 1697599ee301a ("bitfield.h: add FIELD_FIT() helper")

> Link: https://lore.kernel.org/kernel-hardening/CAK7LNASvb0UDJ0U5wkYYRzTAdnEs64HjXpEUL7d=V0CXiAXcNw@mail.gmail.com/

> Reported-by: Masahiro Yamada <masahiroy@kernel.org>

> Debugged-by: Sami Tolvanen <samitolvanen@google.com>

> Signed-off-by: Jakub Kicinski <kuba@kernel.org>

> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>

> ---

> Changes V1->V2:

> * add Fixes tag.


Applied, thank you.
diff mbox series

Patch

diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
index 48ea093ff04c..4e035aca6f7e 100644
--- a/include/linux/bitfield.h
+++ b/include/linux/bitfield.h
@@ -77,7 +77,7 @@ 
  */
 #define FIELD_FIT(_mask, _val)						\
 	({								\
-		__BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: ");	\
+		__BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: ");	\
 		!((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \
 	})