[bug report] bpf: Enforce BPF ringbuf size to be the power of 2

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello Andrii Nakryiko,

The patch 517bbe1994a3: "bpf: Enforce BPF ringbuf size to be the
power of 2" from Jun 29, 2020, leads to the following Smatch static
checker warning:

	kernel/bpf/ringbuf.c:198 ringbuf_map_alloc()
	warn: impossible condition '(attr->max_entries > 68719464448)'

Also Clang warns:

kernel/bpf/ringbuf.c:198:24: warning: result of comparison of constant
68719464448 with expression of type '__u32' (aka 'unsigned int') is
always false [-Wtautological-constant-out-of-range-compare]
        if (attr->max_entries > RINGBUF_MAX_DATA_SZ)
            ~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~

kernel/bpf/ringbuf.c
    184 static struct bpf_map *ringbuf_map_alloc(union bpf_attr *attr)
    185 {
    186         struct bpf_ringbuf_map *rb_map;
    187 
    188         if (attr->map_flags & ~RINGBUF_CREATE_FLAG_MASK)
    189                 return ERR_PTR(-EINVAL);
    190 
    191         if (attr->key_size || attr->value_size ||
    192             !is_power_of_2(attr->max_entries) ||
    193             !PAGE_ALIGNED(attr->max_entries))
    194                 return ERR_PTR(-EINVAL);
    195 
    196 #ifdef CONFIG_64BIT
    197         /* on 32-bit arch, it's impossible to overflow record's hdr->pgoff */
--> 198         if (attr->max_entries > RINGBUF_MAX_DATA_SZ)

This check used to be inside bpf_ringbuf_alloc() and it used be:

	if (data_sz > RINGBUF_MAX_DATA_SZ)

In that context where data_sz is a size_t the condition and the
#ifdef CONFIG_64BIT made sense but here it doesn't.  Probably just
delete the check.

    199                 return ERR_PTR(-E2BIG);
    200 #endif
    201 
    202         rb_map = bpf_map_area_alloc(sizeof(*rb_map), NUMA_NO_NODE);
    203         if (!rb_map)
    204                 return ERR_PTR(-ENOMEM);
    205 
    206         bpf_map_init_from_attr(&rb_map->map, attr);
    207 
    208         rb_map->rb = bpf_ringbuf_alloc(attr->max_entries, rb_map->map.numa_node);
    209         if (!rb_map->rb) {
    210                 bpf_map_area_free(rb_map);
    211                 return ERR_PTR(-ENOMEM);
    212         }
    213 
    214         return &rb_map->map;
    215 }

regards,
dan carpenter




[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux