[PATCH v2 1/2] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

[PATCH v2 1/2] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

[Christophe JAILLET]

ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)
inclusive.
So NFP_MAX_MAC_INDEX (0xff) is a valid id.

In order for the error handling path to work correctly, the 'invalid'
value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,
inclusive.

So set it to -1.

Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
 drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
index cd50db779dda..9244b35e3855 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
@@ -922,8 +922,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
 			  int port, bool mod)
 {
 	struct nfp_flower_priv *priv = app->priv;
-	int ida_idx = NFP_MAX_MAC_INDEX, err;
 	struct nfp_tun_offloaded_mac *entry;
+	int ida_idx = -1, err;
 	u16 nfp_mac_idx = 0;
 
 	entry = nfp_tunnel_lookup_offloaded_macs(app, netdev->dev_addr);
@@ -997,7 +997,7 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
 err_free_entry:
 	kfree(entry);
 err_free_ida:
-	if (ida_idx != NFP_MAX_MAC_INDEX)
+	if (ida_idx != -1)
 		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
 
 	return err;
-- 
2.32.0

[PATCH v2 2/2] nfp: flower: Remove usage of the deprecated ida_simple_xxx API

[Christophe JAILLET]

Use ida_alloc_xxx()/ida_free() instead to
ida_simple_get()/ida_simple_remove().
The latter is deprecated and more verbose.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
 .../net/ethernet/netronome/nfp/flower/tunnel_conf.c    | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
index 9244b35e3855..c71bd555f482 100644
--- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
+++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
@@ -942,8 +942,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
 	if (!nfp_mac_idx) {
 		/* Assign a global index if non-repr or MAC is now shared. */
 		if (entry || !port) {
-			ida_idx = ida_simple_get(&priv->tun.mac_off_ids, 0,
-						 NFP_MAX_MAC_INDEX, GFP_KERNEL);
+			ida_idx = ida_alloc_max(&priv->tun.mac_off_ids,
+						NFP_MAX_MAC_INDEX, GFP_KERNEL);
 			if (ida_idx < 0)
 				return ida_idx;
 
@@ -998,7 +998,7 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
 	kfree(entry);
 err_free_ida:
 	if (ida_idx != -1)
-		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
+		ida_free(&priv->tun.mac_off_ids, ida_idx);
 
 	return err;
 }
@@ -1061,7 +1061,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev,
 		}
 
 		ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index);
-		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
+		ida_free(&priv->tun.mac_off_ids, ida_idx);
 		entry->index = nfp_mac_idx;
 		return 0;
 	}
@@ -1081,7 +1081,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev,
 	/* If MAC has global ID then extract and free the ida entry. */
 	if (nfp_tunnel_is_mac_idx_global(nfp_mac_idx)) {
 		ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index);
-		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
+		ida_free(&priv->tun.mac_off_ids, ida_idx);
 	}
 
 	kfree(entry);
-- 
2.32.0

Re: [PATCH v2 1/2] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

[Simon Horman]

On Thu, Feb 10, 2022 at 11:34:52PM +0100, Christophe JAILLET wrote:
> ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)
> inclusive.
> So NFP_MAX_MAC_INDEX (0xff) is a valid id.
> 
> In order for the error handling path to work correctly, the 'invalid'
> value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,
> inclusive.
> 
> So set it to -1.
> 
> Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

Thanks again for finding and fixing this.

Acked-by: Simon Horman <simon.horman@corigine.com>

Re: [PATCH v2 2/2] nfp: flower: Remove usage of the deprecated ida_simple_xxx API

[Simon Horman]

On Thu, Feb 10, 2022 at 11:35:04PM +0100, Christophe JAILLET wrote:
> Use ida_alloc_xxx()/ida_free() instead to
> ida_simple_get()/ida_simple_remove().
> The latter is deprecated and more verbose.
> 
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

Thanks for noticing and fixing this. It is much appreciated.

Acked-by: Simon Horman <simon.horman@corigine.com>

Re: [PATCH v2 1/2] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

[Jakub Kicinski]

On Thu, 10 Feb 2022 23:34:52 +0100 Christophe JAILLET wrote:
> ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)
> inclusive.
> So NFP_MAX_MAC_INDEX (0xff) is a valid id.
> 
> In order for the error handling path to work correctly, the 'invalid'
> value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,
> inclusive.
> 
> So set it to -1.
> 
> Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

This patch is a fix and the other one is refactoring. They can't be
in the same series because they need to go to different trees. Please
repost the former with [PATCH net] and ~one week later the latter with
[PATCH net-next].

Re: [PATCH v2 1/2] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

[Simon Horman]

On Fri, Feb 11, 2022 at 04:53:56PM -0800, Jakub Kicinski wrote:
> On Thu, 10 Feb 2022 23:34:52 +0100 Christophe JAILLET wrote:
> > ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)
> > inclusive.
> > So NFP_MAX_MAC_INDEX (0xff) is a valid id.
> > 
> > In order for the error handling path to work correctly, the 'invalid'
> > value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,
> > inclusive.
> > 
> > So set it to -1.
> > 
> > Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs")
> > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> 
> This patch is a fix and the other one is refactoring. They can't be
> in the same series because they need to go to different trees. Please
> repost the former with [PATCH net] and ~one week later the latter with
> [PATCH net-next].

Thanks Jakub.

Christophe, please let me know if you'd like me to handle reposting
the patches as described by Jakub.

Re: [PATCH v2 1/2] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

[Christophe JAILLET]

Le 17/02/2022 à 08:59, Simon Horman a écrit :
> On Fri, Feb 11, 2022 at 04:53:56PM -0800, Jakub Kicinski wrote:
>> On Thu, 10 Feb 2022 23:34:52 +0100 Christophe JAILLET wrote:
>>> ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)
>>> inclusive.
>>> So NFP_MAX_MAC_INDEX (0xff) is a valid id.
>>>
>>> In order for the error handling path to work correctly, the 'invalid'
>>> value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,
>>> inclusive.
>>>
>>> So set it to -1.
>>>
>>> Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs")
>>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>>
>> This patch is a fix and the other one is refactoring. They can't be
>> in the same series because they need to go to different trees. Please
>> repost the former with [PATCH net] and ~one week later the latter with
>> [PATCH net-next].
> 
> Thanks Jakub.
> 
> Christophe, please let me know if you'd like me to handle reposting
> the patches as described by Jakub.
> 
Hi,

If you can, it's fine for me.

I must admit that what I consider, as an hobbyist, too much bureaucracy 
is sometimes discouraging.

I do understand the need for maintainers to have things the way they 
need, but, well, maybe sometimes it is too much.

In this particular case, maybe patch 1/2 could be applied to net as-is, 
and 2/2 just dropped because not really useful.


(Just the thoughts of a tired man after a long day at work, don't worry, 
tomorrow, I'll be in a better mood)

CJ

Re: [PATCH v2 1/2] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac()

[Simon Horman]

On Thu, Feb 17, 2022 at 07:20:30PM +0100, Christophe JAILLET wrote:
> Le 17/02/2022 à 08:59, Simon Horman a écrit :
> > On Fri, Feb 11, 2022 at 04:53:56PM -0800, Jakub Kicinski wrote:
> > > On Thu, 10 Feb 2022 23:34:52 +0100 Christophe JAILLET wrote:
> > > > ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX)
> > > > inclusive.
> > > > So NFP_MAX_MAC_INDEX (0xff) is a valid id.
> > > > 
> > > > In order for the error handling path to work correctly, the 'invalid'
> > > > value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range,
> > > > inclusive.
> > > > 
> > > > So set it to -1.
> > > > 
> > > > Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadable devs")
> > > > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> > > 
> > > This patch is a fix and the other one is refactoring. They can't be
> > > in the same series because they need to go to different trees. Please
> > > repost the former with [PATCH net] and ~one week later the latter with
> > > [PATCH net-next].
> > 
> > Thanks Jakub.
> > 
> > Christophe, please let me know if you'd like me to handle reposting
> > the patches as described by Jakub.
> > 
> Hi,
> 
> If you can, it's fine for me.
> 
> I must admit that what I consider, as an hobbyist, too much bureaucracy is
> sometimes discouraging.
> 
> I do understand the need for maintainers to have things the way they need,
> but, well, maybe sometimes it is too much.
> 
> In this particular case, maybe patch 1/2 could be applied to net as-is, and
> 2/2 just dropped because not really useful.
> 
> 
> (Just the thoughts of a tired man after a long day at work, don't worry,
> tomorrow, I'll be in a better mood)

Thanks Christophe,

I appreciate your frustration and apologise for my part in it.

I'll work on getting this short series accepted upstream.

Re: [PATCH v2 2/2] nfp: flower: Remove usage of the deprecated ida_simple_xxx API

[Christophe JAILLET]

Le 10/02/2022 à 23:35, Christophe JAILLET a écrit :
> Use ida_alloc_xxx()/ida_free() instead to
> ida_simple_get()/ida_simple_remove().
> The latter is deprecated and more verbose.
> 
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> ---
>   .../net/ethernet/netronome/nfp/flower/tunnel_conf.c    | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
> index 9244b35e3855..c71bd555f482 100644
> --- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
> +++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
> @@ -942,8 +942,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
>   	if (!nfp_mac_idx) {
>   		/* Assign a global index if non-repr or MAC is now shared. */
>   		if (entry || !port) {
> -			ida_idx = ida_simple_get(&priv->tun.mac_off_ids, 0,
> -						 NFP_MAX_MAC_INDEX, GFP_KERNEL);
> +			ida_idx = ida_alloc_max(&priv->tun.mac_off_ids,
> +						NFP_MAX_MAC_INDEX, GFP_KERNEL);
>   			if (ida_idx < 0)
>   				return ida_idx;
>   
> @@ -998,7 +998,7 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
>   	kfree(entry);
>   err_free_ida:
>   	if (ida_idx != -1)
> -		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
> +		ida_free(&priv->tun.mac_off_ids, ida_idx);
>   
>   	return err;
>   }
> @@ -1061,7 +1061,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev,
>   		}
>   
>   		ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index);
> -		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
> +		ida_free(&priv->tun.mac_off_ids, ida_idx);
>   		entry->index = nfp_mac_idx;
>   		return 0;
>   	}
> @@ -1081,7 +1081,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev,
>   	/* If MAC has global ID then extract and free the ida entry. */
>   	if (nfp_tunnel_is_mac_idx_global(nfp_mac_idx)) {
>   		ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index);
> -		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
> +		ida_free(&priv->tun.mac_off_ids, ida_idx);
>   	}
>   
>   	kfree(entry);

Hi,

This has been merged in -next in commit 432509013f66 but for some reason 
I looked at it again.


I just wanted to point out that this patch DOES change the behavior of 
the driver because ida_simple_get() is exclusive of the upper bound, 
while ida_alloc_max() is inclusive.

So, knowing that NFP_MAX_MAC_INDEX = 0xff = 255, with the previous code 
'ida_idx' was 0 ... 254.
Now it is 0 ... 255.

This still looks good to me, because NFP_MAX_MAC_INDEX is still not a 
power of 2.


But if 255 is a reserved value for whatever reason, then this patch has 
introduced a bug (apologies for it).

The change of behavior should have been mentioned in the commit 
description. So I wanted to make sure you was aware in case a follow-up 
fix is needed.

CJ

Re: [PATCH v2 2/2] nfp: flower: Remove usage of the deprecated ida_simple_xxx API

[Simon Horman]

On Thu, Jun 09, 2022 at 07:11:14AM +0200, Christophe JAILLET wrote:
> Le 10/02/2022 à 23:35, Christophe JAILLET a écrit :
> > Use ida_alloc_xxx()/ida_free() instead to
> > ida_simple_get()/ida_simple_remove().
> > The latter is deprecated and more verbose.
> > 
> > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> > ---
> >   .../net/ethernet/netronome/nfp/flower/tunnel_conf.c    | 10 +++++-----
> >   1 file changed, 5 insertions(+), 5 deletions(-)
> > 
> > diff --git a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
> > index 9244b35e3855..c71bd555f482 100644
> > --- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
> > +++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c
> > @@ -942,8 +942,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
> >   	if (!nfp_mac_idx) {
> >   		/* Assign a global index if non-repr or MAC is now shared. */
> >   		if (entry || !port) {
> > -			ida_idx = ida_simple_get(&priv->tun.mac_off_ids, 0,
> > -						 NFP_MAX_MAC_INDEX, GFP_KERNEL);
> > +			ida_idx = ida_alloc_max(&priv->tun.mac_off_ids,
> > +						NFP_MAX_MAC_INDEX, GFP_KERNEL);
> >   			if (ida_idx < 0)
> >   				return ida_idx;
> > @@ -998,7 +998,7 @@ nfp_tunnel_add_shared_mac(struct nfp_app *app, struct net_device *netdev,
> >   	kfree(entry);
> >   err_free_ida:
> >   	if (ida_idx != -1)
> > -		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
> > +		ida_free(&priv->tun.mac_off_ids, ida_idx);
> >   	return err;
> >   }
> > @@ -1061,7 +1061,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev,
> >   		}
> >   		ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index);
> > -		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
> > +		ida_free(&priv->tun.mac_off_ids, ida_idx);
> >   		entry->index = nfp_mac_idx;
> >   		return 0;
> >   	}
> > @@ -1081,7 +1081,7 @@ nfp_tunnel_del_shared_mac(struct nfp_app *app, struct net_device *netdev,
> >   	/* If MAC has global ID then extract and free the ida entry. */
> >   	if (nfp_tunnel_is_mac_idx_global(nfp_mac_idx)) {
> >   		ida_idx = nfp_tunnel_get_ida_from_global_mac_idx(entry->index);
> > -		ida_simple_remove(&priv->tun.mac_off_ids, ida_idx);
> > +		ida_free(&priv->tun.mac_off_ids, ida_idx);
> >   	}
> >   	kfree(entry);
> 
> Hi,
> 
> This has been merged in -next in commit 432509013f66 but for some reason I
> looked at it again.
> 
> 
> I just wanted to point out that this patch DOES change the behavior of the
> driver because ida_simple_get() is exclusive of the upper bound, while
> ida_alloc_max() is inclusive.
> 
> So, knowing that NFP_MAX_MAC_INDEX = 0xff = 255, with the previous code
> 'ida_idx' was 0 ... 254.
> Now it is 0 ... 255.
> 
> This still looks good to me, because NFP_MAX_MAC_INDEX is still not a power
> of 2.
> 
> 
> But if 255 is a reserved value for whatever reason, then this patch has
> introduced a bug (apologies for it).
> 
> The change of behavior should have been mentioned in the commit description.
> So I wanted to make sure you was aware in case a follow-up fix is needed.

Hi Christophe,

thanks for bringing this to my attention.

When I made my initial review of the patch I did not notice this subtle
change. However, subsequently, the Corigine team did notice and our
conclusion is that it is fine: the code correctly handles all expected
values including 255.

Kind regards,
Simon