linux/tools
Kees Cook ef33f02968 bpf: Replace bpf_lpm_trie_key 0-length array with flexible array
[ Upstream commit 896880ff30 ]

Replace deprecated 0-length array in struct bpf_lpm_trie_key with
flexible array. Found with GCC 13:

../kernel/bpf/lpm_trie.c:207:51: warning: array subscript i is outside array bounds of 'const __u8[0]' {aka 'const unsigned char[]'} [-Warray-bounds=]
  207 |                                        *(__be16 *)&key->data[i]);
      |                                                   ^~~~~~~~~~~~~
../include/uapi/linux/swab.h:102:54: note: in definition of macro '__swab16'
  102 | #define __swab16(x) (__u16)__builtin_bswap16((__u16)(x))
      |                                                      ^
../include/linux/byteorder/generic.h:97:21: note: in expansion of macro '__be16_to_cpu'
   97 | #define be16_to_cpu __be16_to_cpu
      |                     ^~~~~~~~~~~~~
../kernel/bpf/lpm_trie.c:206:28: note: in expansion of macro 'be16_to_cpu'
  206 |                 u16 diff = be16_to_cpu(*(__be16 *)&node->data[i]
^
      |                            ^~~~~~~~~~~
In file included from ../include/linux/bpf.h:7:
../include/uapi/linux/bpf.h:82:17: note: while referencing 'data'
   82 |         __u8    data[0];        /* Arbitrary size */
      |                 ^~~~

And found at run-time under CONFIG_FORTIFY_SOURCE:

  UBSAN: array-index-out-of-bounds in kernel/bpf/lpm_trie.c:218:49
  index 0 is out of range for type '__u8 [*]'

Changing struct bpf_lpm_trie_key is difficult since has been used by
userspace. For example, in Cilium:

	struct egress_gw_policy_key {
	        struct bpf_lpm_trie_key lpm_key;
	        __u32 saddr;
	        __u32 daddr;
	};

While direct references to the "data" member haven't been found, there
are static initializers what include the final member. For example,
the "{}" here:

        struct egress_gw_policy_key in_key = {
                .lpm_key = { 32 + 24, {} },
                .saddr   = CLIENT_IP,
                .daddr   = EXTERNAL_SVC_IP & 0Xffffff,
        };

To avoid the build time and run time warnings seen with a 0-sized
trailing array for struct bpf_lpm_trie_key, introduce a new struct
that correctly uses a flexible array for the trailing bytes,
struct bpf_lpm_trie_key_u8. As part of this, include the "header"
portion (which is just the "prefixlen" member), so it can be used
by anything building a bpf_lpr_trie_key that has trailing members that
aren't a u8 flexible array (like the self-test[1]), which is named
struct bpf_lpm_trie_key_hdr.

Unfortunately, C++ refuses to parse the __struct_group() helper, so
it is not possible to define struct bpf_lpm_trie_key_hdr directly in
struct bpf_lpm_trie_key_u8, so we must open-code the union directly.

Adjust the kernel code to use struct bpf_lpm_trie_key_u8 through-out,
and for the selftest to use struct bpf_lpm_trie_key_hdr. Add a comment
to the UAPI header directing folks to the two new options.

Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Closes: https://paste.debian.net/hidden/ca500597/
Link: https://lore.kernel.org/all/202206281009.4332AA33@keescook/ [1]
Link: https://lore.kernel.org/bpf/20240222155612.it.533-kees@kernel.org
Stable-dep-of: 59f2f84117 ("bpf: Avoid kfree_rcu() under lock in bpf_lpm_trie.")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-08-19 06:04:27 +02:00
..
accounting
arch tools headers arm64: Sync arm64's cputype.h with the kernel sources 2024-08-14 13:59:03 +02:00
bootconfig
bpf tools/resolve_btfids: Fix comparison of distinct pointer types warning in resolve_btfids 2024-08-03 08:54:37 +02:00
build perf cs-etm: Bump minimum OpenCSD version to ensure a bugfix is present 2024-02-05 20:14:31 +00:00
certs
cgroup
counter
crypto/ccp crypto: ccp - Fix some unfused tests 2023-11-20 11:59:18 +01:00
debugging
edid
firewire
firmware
gpio
hv hv/hv_kvp_daemon: Some small fixes for handling NM keyfiles 2023-12-03 07:33:02 +01:00
iio tools: iio: replace seekdir() in iio_generic_buffer 2024-04-13 13:07:38 +02:00
include bpf: Replace bpf_lpm_trie_key 0-length array with flexible array 2024-08-19 06:04:27 +02:00
kvm/kvm_stat
laptop
leds
lib libbpf: Fix no-args func prototype BTF dumping syntax 2024-08-03 08:54:36 +02:00
memory-model tools/memory-model: Fix bug in lock.cat 2024-08-03 08:54:21 +02:00
mm tools/mm: fix undefined reference to pthread_once 2023-09-05 10:13:45 -07:00
net/ynl tools: ynl: don't ignore errors in NLMSG_DONE messages 2024-05-02 16:32:36 +02:00
objtool objtool: Fix UNWIND_HINT_{SAVE,RESTORE} across basic blocks 2024-03-26 18:19:35 -04:00
pci
pcmcia
perf perf tool: fix dereferencing NULL al->maps 2024-08-11 12:47:18 +02:00
power tools/power/cpupower: Fix Pstate frequency reporting on AMD Family 1Ah CPUs 2024-07-25 09:50:41 +02:00
rcu
scripts
spi
testing bpf: Replace bpf_lpm_trie_key 0-length array with flexible array 2024-08-19 06:04:27 +02:00
thermal
time
tracing rtla/auto-analysis: Replace \t with spaces 2024-06-21 14:38:42 +02:00
usb
verification tools/rv: Fix Makefile compiler options for clang 2024-02-23 09:25:14 +01:00
virtio tools/virtio: Add dma sync api for virtio test 2023-10-16 05:32:23 -04:00
wmi
workqueue
Makefile