Received-SPF: pass (google.com: domain of linux-kernel+bounces-126805-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
From: Erick Archer <erick.archer@outlook.com>
To: Long Li <longli@microsoft.com>,
	Ajay Sharma <sharmaajay@microsoft.com>,
	Jason Gunthorpe <jgg@ziepe.ca>,
	Leon Romanovsky <leon@kernel.org>,
	"K. Y. Srinivasan" <kys@microsoft.com>,
	Haiyang Zhang <haiyangz@microsoft.com>,
	Wei Liu <wei.liu@kernel.org>,
	Dexuan Cui <decui@microsoft.com>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>,
	Shradha Gupta <shradhagupta@linux.microsoft.com>,
	Konstantin Taranov <kotaranov@microsoft.com>,
	Kees Cook <keescook@chromium.org>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: Erick Archer <erick.archer@outlook.com>,
	linux-rdma@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	linux-hyperv@vger.kernel.org,
	netdev@vger.kernel.org,
	linux-hardening@vger.kernel.org
Subject: [PATCH v2] RDMA/mana_ib: Add flex array to struct mana_cfg_rx_steer_req_v2
Date: Mon,  1 Apr 2024 17:37:03 +0200
Message-ID:
 <AS8PR02MB723729C5A63F24C312FC9CD18B3F2@AS8PR02MB7237.eurprd02.prod.outlook.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: AS8PR02MB7237:EE_|PAVPR02MB9891:EE_
X-MS-Office365-Filtering-Correlation-Id: da2c7ad5-2494-4da9-b168-08dc5261a323
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info:
	FEYsG8lwpfYg2ZhSb2TXGs2vIwWEhU+QicVRwrjPsfisBBroSalmmyZgmyvq/mCuAmhi/dqBXJVQkTYH2QWwTXXeukaNa0KOyp71x5ZFdTw0dNtCmUJzD0fORD0ZaH39ReDM7OeIG9dPOtguZYreQjAZMQ814/Ju4IXa7EPLNRgljyZhImBSFJfiKst5b9G1V9DZ8/BRPshDBn5Kn6bbCgXSJS9zi65P2zAhHj4EIsE0HwRfn4V+UJufBLz1CjZQVYrTaoc9biQ95qRoHItkpusaEL2ZfWWDzWaVRx8/TRQpDhdLC+O6TvHTptv5FEr7venZZh7V4dh6V4WremtjHfb1Pk6LKy2K+WVgxDzc7UV8Fn44uw814df1lnSi26QF3IbTuLQNzovDV6kZSQmLW88X14Nsn5rz45EMSFzklGhMpBvXclG3lG1rn48jC4ZknGPyB7H0hMTK/dB+NwVIs3klsE4FoF6w51zUgJcpRSW4xUvPLxwccvS5xdZ21RApdCkSCze1EeHOUvxGDXumBGvLeZI8A/6gceaumNKzQkisJOyPIqiVuJe79H31sW1r6HIZ00jLLYUlownMsqAkiBwAFSS3jGD5hKvTE3hq6cZZ5Tg5x34Pubs2yvP7skW+bbrRU+Beiyo5SdcueA5+FsvXT3f9FLYwFnXRDWMeCvGZt131xrNMEqFGxwR3VWcX
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?us-ascii?Q?1wmFSfklgBu10unlWvDB52wfRmVX1C4KcOunlGrf/4MKvup9sY6cnU1Raih5?=
 =?us-ascii?Q?UlBFoVqHm40GurLaFPB8AYrBaAFAL7jTDQ3mXH4eLqXaUE8tgymNbUde5iLJ?=
 =?us-ascii?Q?kacNeZDy3nCmiIuUu/TOZ6Ufj1/u6UT1MA6uNkWbsVngHrndG1y8iYTGXlUo?=
 =?us-ascii?Q?5XHZZ/57E1BRkvjaEriSxYDMAGt0mEP9f82E+ZNxdj0fDmshjuQ6FyoW2Dql?=
 =?us-ascii?Q?duivUWTtgRb0pxcQSKSp3EKHZn+JqfHyf4blWbotn6Xz3cTo9aUM91N9HoUA?=
 =?us-ascii?Q?FjakWhR91C0ndIrhp22PY9xtwn8hUVDzr2nbT/MRgGK4BijtvuU46PmsWjyM?=
 =?us-ascii?Q?pCZpBygew6YU3eBP4Tdpl0Z07TDOhYnzbdK4FAY+hiuoFuwOHQYIv3rV6+Nc?=
 =?us-ascii?Q?PBxD2PZUaPRhb7EIAPKx3a3wlv5v73KFqQApnMP6MZ6WxE2i/iwts2lMBjxs?=
 =?us-ascii?Q?aOYBg1Wy+vf8meVH2Gb+SEkSL0CIb4pWaA3lZgNK9LZNXsJnHcb2G88ORdy0?=
 =?us-ascii?Q?/cDcgUcdfNzdb2Q8e4E/kLMglBpIVl7KO/EsWJqlLX1kDiQ0jqpb5iv0oCv1?=
 =?us-ascii?Q?GF4WWa8nxmqEHUiR64FOdASr9RYixfIuPeG/x78y/8nyMTya7D0hknRNaOY9?=
 =?us-ascii?Q?fhd7sHPAFXNHwun/2BbKx7Znu6oMVe4451yPyHh59vm7/smkg7mPiracXO+c?=
 =?us-ascii?Q?C9Uilz1fdU9f8n7POQlPa1/OMzhXC3kMjkUcnqMCXMxTMQuK8EzQR5F2C73g?=
 =?us-ascii?Q?ltN83PAFrp/0xFzoeRl0Fk9kRFIeJ1y5QZZWvtQ08+4/L1XbZ6VTr767bXU4?=
 =?us-ascii?Q?0EzCqsnfsfdIoVCqXOYb913j4/JfEiXOJG7mWEMne8THNo1lj6utQzP7BsCq?=
 =?us-ascii?Q?zFu3wqKrK3LSGIrjaxR89EVyhuO1ZOP9slKiqXp7OvgUsWnyMYK3+4JXQT5j?=
 =?us-ascii?Q?TDrwMlDG7K/LCYsdw8sY07sabl+fpbNgkpIol4I7xj5Zuu4sKbhYqz2EtUFK?=
 =?us-ascii?Q?a9Dy5gqUoIy72PZdxvMLBZ8W6cjqT/8F4/U7aUW/+sTuxuz1akwLPARBj1LJ?=
 =?us-ascii?Q?l801EmhXgS0i5dAD+eBksTN6R3ii07P+eAvj43CpYrVuMz6r45lF8E4vi6gw?=
 =?us-ascii?Q?xP1lZhoGi4tRtLzQRD3kEGDnqc0h1e4mO9DgjbjVPCXMGPQMo6LSeNkeEjrn?=
 =?us-ascii?Q?GWAbo6JODr248rcmix0w7YaNNgpsD++O8BMvHxxioMNN9vbtVVj+PbuMtfN4?=
 =?us-ascii?Q?D26cF0vUwqaJPuxD5bSb?=
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: da2c7ad5-2494-4da9-b168-08dc5261a323
X-MS-Exchange-CrossTenant-AuthSource: AS8PR02MB7237.eurprd02.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Apr 2024 15:37:29.6055
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg:
	00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVPR02MB9891

The "struct mana_cfg_rx_steer_req_v2" uses a dynamically sized set of
trailing elements. Specifically, it uses a "mana_handle_t" array. So,
use the preferred way in the kernel declaring a flexible array [1].

At the same time, prepare for the coming implementation by GCC and Clang
of the __counted_by attribute. Flexible array members annotated with
__counted_by can have their accesses bounds-checked at run-time via
CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for
strcpy/memcpy-family functions).

Also, avoid the open-coded arithmetic in the memory allocator functions
[2] using the "struct_size" macro.

Moreover, use the "offsetof" helper to get the indirect table offset
instead of the "sizeof" operator and avoid the open-coded arithmetic in
pointers using the new flex member. This new structure member also allow
us to remove the "req_indir_tab" variable since it is no longer needed.

Now, it is also possible to use the "flex_array_size" helper to compute
the size of these trailing elements in the "memcpy" function.

This code was detected with the help of Coccinelle, and audited and
modified manually.

Link: https://www.kernel.org/doc/html/next/process/deprecated.html#zero-length-and-one-element-arrays [1]
Link: https://www.kernel.org/doc/html/next/process/deprecated.html#open-coded-arithmetic-in-allocator-arguments [2]
Signed-off-by: Erick Archer <erick.archer@outlook.com>
---
Changes in v2:
- Remove the "req_indir_tab" variable (Gustavo A. R. Silva).
- Update the commit message.
- Add the "__counted_by" attribute.

Previous versions:
v1 -> https://lore.kernel.org/linux-hardening/AS8PR02MB7237974EF1B9BAFA618166C38B382@AS8PR02MB7237.eurprd02.prod.outlook.com/

Hi,

The Coccinelle script used to detect this code pattern is the following:

virtual report

@rule1@
type t1;
type t2;
identifier i0;
identifier i1;
identifier i2;
identifier ALLOC =~ "kmalloc|kzalloc|kmalloc_node|kzalloc_node|vmalloc|vzalloc|kvmalloc|kvzalloc";
position p1;
@@

i0 = sizeof(t1) + sizeof(t2) * i1;
..
i2 = ALLOC@p1(..., i0, ...);

@script:python depends on report@
p1 << rule1.p1;
@@

msg = "WARNING: verify allocation on line %s" % (p1[0].line)
coccilib.report.print_report(p1[0],msg)

Regards,
Erick
---
 drivers/infiniband/hw/mana/qp.c               | 12 +++++-------
 drivers/net/ethernet/microsoft/mana/mana_en.c | 14 ++++++--------
 include/net/mana/mana.h                       |  1 +
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c
index 6e7627745c95..258f89464c10 100644
--- a/drivers/infiniband/hw/mana/qp.c
+++ b/drivers/infiniband/hw/mana/qp.c
@@ -15,15 +15,13 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
 	struct mana_port_context *mpc = netdev_priv(ndev);
 	struct mana_cfg_rx_steer_req_v2 *req;
 	struct mana_cfg_rx_steer_resp resp = {};
-	mana_handle_t *req_indir_tab;
 	struct gdma_context *gc;
 	u32 req_buf_size;
 	int i, err;
 
 	gc = mdev_to_gc(dev);
 
-	req_buf_size =
-		sizeof(*req) + sizeof(mana_handle_t) * MANA_INDIRECT_TABLE_SIZE;
+	req_buf_size = struct_size(req, indir_tab, MANA_INDIRECT_TABLE_SIZE);
 	req = kzalloc(req_buf_size, GFP_KERNEL);
 	if (!req)
 		return -ENOMEM;
@@ -44,20 +42,20 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev,
 		req->rss_enable = true;
 
 	req->num_indir_entries = MANA_INDIRECT_TABLE_SIZE;
-	req->indir_tab_offset = sizeof(*req);
+	req->indir_tab_offset = offsetof(struct mana_cfg_rx_steer_req_v2,
+					 indir_tab);
 	req->update_indir_tab = true;
 	req->cqe_coalescing_enable = 1;
 
-	req_indir_tab = (mana_handle_t *)(req + 1);
 	/* The ind table passed to the hardware must have
 	 * MANA_INDIRECT_TABLE_SIZE entries. Adjust the verb
 	 * ind_table to MANA_INDIRECT_TABLE_SIZE if required
 	 */
 	ibdev_dbg(&dev->ib_dev, "ind table size %u\n", 1 << log_ind_tbl_size);
 	for (i = 0; i < MANA_INDIRECT_TABLE_SIZE; i++) {
-		req_indir_tab[i] = ind_table[i % (1 << log_ind_tbl_size)];
+		req->indir_tab[i] = ind_table[i % (1 << log_ind_tbl_size)];
 		ibdev_dbg(&dev->ib_dev, "index %u handle 0x%llx\n", i,
-			  req_indir_tab[i]);
+			  req->indir_tab[i]);
 	}
 
 	req->update_hashkey = true;
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index 59287c6e6cee..62bf3e5661a6 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -1058,11 +1058,10 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
 	struct mana_cfg_rx_steer_req_v2 *req;
 	struct mana_cfg_rx_steer_resp resp = {};
 	struct net_device *ndev = apc->ndev;
-	mana_handle_t *req_indir_tab;
 	u32 req_buf_size;
 	int err;
 
-	req_buf_size = sizeof(*req) + sizeof(mana_handle_t) * num_entries;
+	req_buf_size = struct_size(req, indir_tab, num_entries);
 	req = kzalloc(req_buf_size, GFP_KERNEL);
 	if (!req)
 		return -ENOMEM;
@@ -1074,7 +1073,8 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
 
 	req->vport = apc->port_handle;
 	req->num_indir_entries = num_entries;
-	req->indir_tab_offset = sizeof(*req);
+	req->indir_tab_offset = offsetof(struct mana_cfg_rx_steer_req_v2,
+					 indir_tab);
 	req->rx_enable = rx;
 	req->rss_enable = apc->rss_state;
 	req->update_default_rxobj = update_default_rxobj;
@@ -1086,11 +1086,9 @@ static int mana_cfg_vport_steering(struct mana_port_context *apc,
 	if (update_key)
 		memcpy(&req->hashkey, apc->hashkey, MANA_HASH_KEY_SIZE);
 
-	if (update_tab) {
-		req_indir_tab = (mana_handle_t *)(req + 1);
-		memcpy(req_indir_tab, apc->rxobj_table,
-		       req->num_indir_entries * sizeof(mana_handle_t));
-	}
+	if (update_tab)
+		memcpy(req->indir_tab, apc->rxobj_table,
+		       flex_array_size(req, indir_tab, req->num_indir_entries));
 
 	err = mana_send_request(apc->ac, req, req_buf_size, &resp,
 				sizeof(resp));
diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h
index 76147feb0d10..46f741ebce21 100644
--- a/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -671,6 +671,7 @@ struct mana_cfg_rx_steer_req_v2 {
 	u8 hashkey[MANA_HASH_KEY_SIZE];
 	u8 cqe_coalescing_enable;
 	u8 reserved2[7];
+	mana_handle_t indir_tab[] __counted_by(num_indir_entries);
 }; /* HW DATA */
 
 struct mana_cfg_rx_steer_resp {
-- 
2.25.1