2021-10-18 11:32:22

by 王擎

Subject: [PATCH V2] net: bpf: switch over to memdup_user()

This patch fixes the following Coccinelle warning:

net/bpf/test_run.c:361:8-15: WARNING opportunity for memdup_user
net/bpf/test_run.c:1055:8-15: WARNING opportunity for memdup_user

Use memdup_user rather than duplicating its implementation
This is a little bit restricted to reduce false positives

Signed-off-by: Qing Wang <[email protected]>
---
net/bpf/test_run.c | 21 ++++++---------------
1 file changed, 6 insertions(+), 15 deletions(-)

diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
index 5296087..fbda8f5
--- a/net/bpf/test_run.c
+++ b/net/bpf/test_run.c
@@ -358,13 +358,9 @@ int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
return -EINVAL;

if (ctx_size_in) {
- info.ctx = kzalloc(ctx_size_in, GFP_USER);
- if (!info.ctx)
- return -ENOMEM;
- if (copy_from_user(info.ctx, ctx_in, ctx_size_in)) {
- err = -EFAULT;
- goto out;
- }
+ info.ctx = memdup_user(ctx_in, ctx_size_in);
+ if (IS_ERR(info.ctx))
+ return PTR_ERR(info.ctx);
} else {
info.ctx = NULL;
}
@@ -392,7 +388,6 @@ int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
copy_to_user(&uattr->test.retval, &info.retval, sizeof(u32)))
err = -EFAULT;

-out:
kfree(info.ctx);
return err;
}
@@ -1052,13 +1047,9 @@ int bpf_prog_test_run_syscall(struct bpf_prog *prog,
return -EINVAL;

if (ctx_size_in) {
- ctx = kzalloc(ctx_size_in, GFP_USER);
- if (!ctx)
- return -ENOMEM;
- if (copy_from_user(ctx, ctx_in, ctx_size_in)) {
- err = -EFAULT;
- goto out;
- }
+ ctx = memdup_user(ctx_in, ctx_size_in);
+ if (IS_ERR(ctx))
+ return PTR_ERR(ctx);
}

rcu_read_lock_trace();
--
2.7.4

2021-10-18 16:28:26

by John Fastabend

Subject: RE: [PATCH V2] net: bpf: switch over to memdup_user()

Qing Wang wrote:
> This patch fixes the following Coccinelle warning:
>
> net/bpf/test_run.c:361:8-15: WARNING opportunity for memdup_user
> net/bpf/test_run.c:1055:8-15: WARNING opportunity for memdup_user
>
> Use memdup_user rather than duplicating its implementation
> This is a little bit restricted to reduce false positives
>
> Signed-off-by: Qing Wang <[email protected]>
> ---
> net/bpf/test_run.c | 21 ++++++---------------
> 1 file changed, 6 insertions(+), 15 deletions(-)

LGTM, but subject line should be '[PATCH bpf-next v2]' there is no reason
to push to fixes trees here.

Also might be worth noting that the original kzalloc could have just been
a kalloc because copy_from_user will zero any extra bytes.

Acked-by: John Fastabend <[email protected]>

>
> diff --git a/net/bpf/test_run.c b/net/bpf/test_run.c
> index 5296087..fbda8f5
> --- a/net/bpf/test_run.c
> +++ b/net/bpf/test_run.c
> @@ -358,13 +358,9 @@ int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
> return -EINVAL;
>
> if (ctx_size_in) {
> - info.ctx = kzalloc(ctx_size_in, GFP_USER);
> - if (!info.ctx)
> - return -ENOMEM;
> - if (copy_from_user(info.ctx, ctx_in, ctx_size_in)) {
> - err = -EFAULT;
> - goto out;
> - }
> + info.ctx = memdup_user(ctx_in, ctx_size_in);
> + if (IS_ERR(info.ctx))
> + return PTR_ERR(info.ctx);
> } else {
> info.ctx = NULL;
> }
> @@ -392,7 +388,6 @@ int bpf_prog_test_run_raw_tp(struct bpf_prog *prog,
> copy_to_user(&uattr->test.retval, &info.retval, sizeof(u32)))
> err = -EFAULT;
>
> -out:
> kfree(info.ctx);
> return err;
> }
> @@ -1052,13 +1047,9 @@ int bpf_prog_test_run_syscall(struct bpf_prog *prog,
> return -EINVAL;
>
> if (ctx_size_in) {
> - ctx = kzalloc(ctx_size_in, GFP_USER);
> - if (!ctx)
> - return -ENOMEM;
> - if (copy_from_user(ctx, ctx_in, ctx_size_in)) {
> - err = -EFAULT;
> - goto out;
> - }
> + ctx = memdup_user(ctx_in, ctx_size_in);
> + if (IS_ERR(ctx))
> + return PTR_ERR(ctx);
> }
>
> rcu_read_lock_trace();
> --
> 2.7.4
>