[PATCH] libbpf hashmap: Avoid undefined behavior in hash_bits

[PATCH] libbpf hashmap: Avoid undefined behavior in hash_bits

[Ian Rogers]

If bits is 0, the case when the map is empty, then the >> is the size of
the register which is undefined behavior - on x86 it is the same as a
shift by 0.
Avoid calling hash_bits with bits == 0 by adding additional empty
hashmap tests.

Suggested-by: Andrii Nakryiko <andriin@fb.com>,
Suggested-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/lib/bpf/hashmap.c | 12 ++++++++++--
 tools/lib/bpf/hashmap.h | 12 ++++++------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/tools/lib/bpf/hashmap.c b/tools/lib/bpf/hashmap.c
index 3c20b126d60d..41e6f636101e 100644
--- a/tools/lib/bpf/hashmap.c
+++ b/tools/lib/bpf/hashmap.c
@@ -156,7 +156,7 @@ int hashmap__insert(struct hashmap *map, const void *key, void *value,
 		    const void **old_key, void **old_value)
 {
 	struct hashmap_entry *entry;
-	size_t h;
+	size_t h = 0;
 	int err;
 
 	if (old_key)
@@ -164,7 +164,9 @@ int hashmap__insert(struct hashmap *map, const void *key, void *value,
 	if (old_value)
 		*old_value = NULL;
 
-	h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
+	if (map->buckets)
+		h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
+
 	if (strategy != HASHMAP_APPEND &&
 	    hashmap_find_entry(map, key, h, NULL, &entry)) {
 		if (old_key)
@@ -208,6 +210,9 @@ bool hashmap__find(const struct hashmap *map, const void *key, void **value)
 	struct hashmap_entry *entry;
 	size_t h;
 
+	if (!map->buckets)
+		return false;
+
 	h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
 	if (!hashmap_find_entry(map, key, h, NULL, &entry))
 		return false;
@@ -223,6 +228,9 @@ bool hashmap__delete(struct hashmap *map, const void *key,
 	struct hashmap_entry **pprev, *entry;
 	size_t h;
 
+	if (!map->buckets)
+		return false;
+
 	h = hash_bits(map->hash_fn(key, map->ctx), map->cap_bits);
 	if (!hashmap_find_entry(map, key, h, &pprev, &entry))
 		return false;
diff --git a/tools/lib/bpf/hashmap.h b/tools/lib/bpf/hashmap.h
index d9b385fe808c..61236437876e 100644
--- a/tools/lib/bpf/hashmap.h
+++ b/tools/lib/bpf/hashmap.h
@@ -174,17 +174,17 @@ bool hashmap__find(const struct hashmap *map, const void *key, void **value);
  * @key: key to iterate entries for
  */
 #define hashmap__for_each_key_entry(map, cur, _key)			    \
-	for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\
-					     map->cap_bits);		    \
-		     map->buckets ? map->buckets[bkt] : NULL; });	    \
+	for (cur = map->buckets						    \
+		     ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \
+		     : NULL;						    \
 	     cur;							    \
 	     cur = cur->next)						    \
 		if (map->equal_fn(cur->key, (_key), map->ctx))
 
 #define hashmap__for_each_key_entry_safe(map, cur, tmp, _key)		    \
-	for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\
-					     map->cap_bits);		    \
-		     cur = map->buckets ? map->buckets[bkt] : NULL; });	    \
+	for (cur = map->buckets						    \
+		     ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \
+		     : NULL;						    \
 	     cur && ({ tmp = cur->next; true; });			    \
 	     cur = tmp)							    \
 		if (map->equal_fn(cur->key, (_key), map->ctx))
-- 
2.29.1.341.ge80a0c044ae-goog

Re: [PATCH] libbpf hashmap: Avoid undefined behavior in hash_bits

[Andrii Nakryiko]

On Thu, Oct 29, 2020 at 3:10 PM Ian Rogers <irogers@google.com> wrote:
>
> If bits is 0, the case when the map is empty, then the >> is the size of
> the register which is undefined behavior - on x86 it is the same as a
> shift by 0.
> Avoid calling hash_bits with bits == 0 by adding additional empty
> hashmap tests.
>
> Suggested-by: Andrii Nakryiko <andriin@fb.com>,
> Suggested-by: Song Liu <songliubraving@fb.com>
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---

I didn't realize you'd need to add three extra checks. If that's the
case, let's just add `if (!bits) return 0;` to hash_bits() and be done
with it. Please keep
hashmap__for_each_key_entry_safe/hashmap__for_each_key_entry changes,
they are ok regardless.

>  tools/lib/bpf/hashmap.c | 12 ++++++++++--
>  tools/lib/bpf/hashmap.h | 12 ++++++------
>  2 files changed, 16 insertions(+), 8 deletions(-)
>

[...]