[PATCH bpf-next] bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set

[PATCH bpf-next] bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set

[Yonghong Song]

With CONFIG_DEBUG_INFO_BTF not set, we hit the following compilation error,
  /.../kernel/bpf/verifier.c:8196:23: error: array index 6 is past the end of the array
  (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
        if (meta->func_id == special_kfunc_list[KF_bpf_cast_to_kern_ctx])
                             ^                  ~~~~~~~~~~~~~~~~~~~~~~~
  /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
  BTF_ID_LIST(special_kfunc_list)
  ^
  /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
  #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
                            ^
  /.../kernel/bpf/verifier.c:8443:19: error: array index 5 is past the end of the array
  (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
                 btf_id == special_kfunc_list[KF_bpf_list_pop_back];
                           ^                  ~~~~~~~~~~~~~~~~~~~~
  /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
  BTF_ID_LIST(special_kfunc_list)
  ^
  /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
  #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
  ...

Fix the problem by increase the size of BTF_ID_LIST to 8 to avoid compilation error
and also prevent potentially unintended issue due to out-of-bound access.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Yonghong Song <yhs@fb.com>
---
 include/linux/btf_ids.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h
index c9744efd202f..71d0ce707744 100644
--- a/include/linux/btf_ids.h
+++ b/include/linux/btf_ids.h
@@ -204,7 +204,7 @@ extern struct btf_id_set8 name;
 
 #else
 
-#define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
+#define BTF_ID_LIST(name) static u32 __maybe_unused name[8];
 #define BTF_ID(prefix, name)
 #define BTF_ID_FLAGS(prefix, name, ...)
 #define BTF_ID_UNUSED
-- 
2.30.2

Re: [PATCH bpf-next] bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set

[Alexei Starovoitov]

On Wed, Nov 23, 2022 at 7:58 AM Yonghong Song <yhs@fb.com> wrote:
>
> With CONFIG_DEBUG_INFO_BTF not set, we hit the following compilation error,
>   /.../kernel/bpf/verifier.c:8196:23: error: array index 6 is past the end of the array
>   (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
>         if (meta->func_id == special_kfunc_list[KF_bpf_cast_to_kern_ctx])
>                              ^                  ~~~~~~~~~~~~~~~~~~~~~~~
>   /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
>   BTF_ID_LIST(special_kfunc_list)
>   ^
>   /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
>   #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
>                             ^
>   /.../kernel/bpf/verifier.c:8443:19: error: array index 5 is past the end of the array
>   (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
>                  btf_id == special_kfunc_list[KF_bpf_list_pop_back];
>                            ^                  ~~~~~~~~~~~~~~~~~~~~
>   /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
>   BTF_ID_LIST(special_kfunc_list)
>   ^
>   /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
>   #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
>   ...
>
> Fix the problem by increase the size of BTF_ID_LIST to 8 to avoid compilation error
> and also prevent potentially unintended issue due to out-of-bound access.
>
> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <error27@gmail.com>
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Signed-off-by: Yonghong Song <yhs@fb.com>
> ---
>  include/linux/btf_ids.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h
> index c9744efd202f..71d0ce707744 100644
> --- a/include/linux/btf_ids.h
> +++ b/include/linux/btf_ids.h
> @@ -204,7 +204,7 @@ extern struct btf_id_set8 name;
>
>  #else
>
> -#define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
> +#define BTF_ID_LIST(name) static u32 __maybe_unused name[8];

Changed it to 16 while applying so we don't have to bump it
again in the near future when another special kfunc is added.

Re: [PATCH bpf-next] bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 23 Nov 2022 07:57:59 -0800 you wrote:
> With CONFIG_DEBUG_INFO_BTF not set, we hit the following compilation error,
>   /.../kernel/bpf/verifier.c:8196:23: error: array index 6 is past the end of the array
>   (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
>         if (meta->func_id == special_kfunc_list[KF_bpf_cast_to_kern_ctx])
>                              ^                  ~~~~~~~~~~~~~~~~~~~~~~~
>   /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
>   BTF_ID_LIST(special_kfunc_list)
>   ^
>   /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
>   #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
>                             ^
>   /.../kernel/bpf/verifier.c:8443:19: error: array index 5 is past the end of the array
>   (that has type 'u32[5]' (aka 'unsigned int[5]')) [-Werror,-Warray-bounds]
>                  btf_id == special_kfunc_list[KF_bpf_list_pop_back];
>                            ^                  ~~~~~~~~~~~~~~~~~~~~
>   /.../kernel/bpf/verifier.c:8174:1: note: array 'special_kfunc_list' declared here
>   BTF_ID_LIST(special_kfunc_list)
>   ^
>   /.../include/linux/btf_ids.h:207:27: note: expanded from macro 'BTF_ID_LIST'
>   #define BTF_ID_LIST(name) static u32 __maybe_unused name[5];
>   ...
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Fix a BTF_ID_LIST bug with CONFIG_DEBUG_INFO_BTF not set
    https://git.kernel.org/bpf/bpf-next/c/beb3d47d1d3d

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html