Re: [PATCH] bitfield.h: don't compile-time validate _val in FIELD_FIT

[Alex Elder <elder@linaro.org>]

On 7/8/20 12:10 PM, Nick Desaulniers wrote:
> On Tue, Jul 7, 2020 at 3:43 PM Alex Elder <elder@linaro.org> wrote:
>>
>> On 7/7/20 4:16 PM, Nick Desaulniers wrote:
>>> From: Jakub Kicinski <kuba@kernel.org>
>>>
>>> When ur_load_imm_any() is inlined into jeq_imm(), it's possible for the
>>> compiler to deduce a case where _val can only have the value of -1 at
>>> compile time. Specifically,
>>>
>>> /* struct bpf_insn: _s32 imm */
>>> u64 imm = insn->imm; /* sign extend */
>>> if (imm >> 32) { /* non-zero only if insn->imm is negative */
>>>   /* inlined from ur_load_imm_any */
>>>   u32 __imm = imm >> 32; /* therefore, always 0xffffffff */
>>>   if (__builtin_constant_p(__imm) && __imm > 255)
>>>     compiletime_assert_XXX()
>>>
>>> This can result in tripping a BUILD_BUG_ON() in __BF_FIELD_CHECK() that
>>> checks that a given value is representable in one byte (interpreted as
>>> unsigned).
> 
> Hi Alex,
> Thanks for taking a look. They're good and fair questions.
> 
>>
>> Why does FIELD_FIT() pass an unsigned long long value as the second
>> argument to __BF_FIELD_CHECK()?
> 
> Was Jakub's suggestion; I don't feel strongly against it either way, though...
> 
>> Could it pass (typeof(_mask))0 instead?
> 
> ...might be nice to avoid implicit promotions and conversions if _mask
> is not the same sizeof _val.
> 
>> It wouldn't fix this particular case, because UR_REG_IMM_MAX is also
>> defined with that type.  But (without working through this in more
>> detail) it seems like there might be a solution that preserves the
>> compile-time checking.
> 
> I'd argue the point of the patch is to not check at compile time for
> FIELD_FIT, since we have a case in
> drivers/net/ethernet/netronome/nfp/bpf/jit.c (jeq_imm()) that will
> always pass -1 (unintentionally due to compiler optimization).

I understand why something needs to be done to handle that case.
There's fancy macro gymnastics in "bitfield.h" to add convenient
build-time checks for usage problems; I just thought there might
be something we could do to preserve the checking--even in this
case.  But figuring that out takes more time than I was willing
to spend on it yesterday...

>> A second comment about this is that it might be nice to break
>> __BF_FIELD_CHECK() into the parts that verify the mask (which
>> could be used by FIELD_FIT() here) and the parts that verify
>> other things.
> 
> Like so? Jakub, WDYT? Or do you prefer v1+Alex's suggestion about
> using `(typeof(_mask))0` in place of 0ULL?

Yes, very much like that!  But you could do that as a follow-on
instead, so as not to delay or confuse things.

Thanks.

					-Alex

> diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c
> b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c
> index 311a5be25acb..938fc733fccb 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c
> +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp_eth.c
> @@ -492,11 +492,12 @@ nfp_eth_set_bit_config(struct nfp_nsp *nsp,
> unsigned int raw_idx,
>         return 0;
>  }
> 
> -#define NFP_ETH_SET_BIT_CONFIG(nsp, raw_idx, mask, val, ctrl_bit)      \
> -       ({                                                              \
> -               __BF_FIELD_CHECK(mask, 0ULL, val, "NFP_ETH_SET_BIT_CONFIG: "); \
> -               nfp_eth_set_bit_config(nsp, raw_idx, mask, __bf_shf(mask), \
> -                                      val, ctrl_bit);                  \
> +#define NFP_ETH_SET_BIT_CONFIG(nsp, raw_idx, mask, val, ctrl_bit)
>          \
> +       ({
>          \
> +               __BF_FIELD_CHECK_MASK(mask, "NFP_ETH_SET_BIT_CONFIG:
> ");        \
> +               __BF_FIELD_CHECK_VAL(mask, val,
> "NFP_ETH_SET_BIT_CONFIG: ");    \
> +               nfp_eth_set_bit_config(nsp, raw_idx, mask,
> __bf_shf(mask),      \
> +                                      val, ctrl_bit);
>          \
>         })
> 
>  /**
> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
> index 48ea093ff04c..79651867beb3 100644
> --- a/include/linux/bitfield.h
> +++ b/include/linux/bitfield.h
> @@ -41,18 +41,26 @@
> 
>  #define __bf_shf(x) (__builtin_ffsll(x) - 1)
> 
> -#define __BF_FIELD_CHECK(_mask, _reg, _val, _pfx)                      \
> +#define __BF_FIELD_CHECK_MASK(_mask, _pfx)                             \
>         ({                                                              \
>                 BUILD_BUG_ON_MSG(!__builtin_constant_p(_mask),          \
>                                  _pfx "mask is not constant");          \
>                 BUILD_BUG_ON_MSG((_mask) == 0, _pfx "mask is zero");    \
> +               __BUILD_BUG_ON_NOT_POWER_OF_2((_mask) +                 \
> +                                             (1ULL << __bf_shf(_mask))); \
> +       })
> +
> +#define __BF_FIELD_CHECK_VAL(_mask, _val, _pfx)
>          \
> +       ({                                                              \
>                 BUILD_BUG_ON_MSG(__builtin_constant_p(_val) ?           \
>                                  ~((_mask) >> __bf_shf(_mask)) & (_val) : 0, \
>                                  _pfx "value too large for the field"); \
> -               BUILD_BUG_ON_MSG((_mask) > (typeof(_reg))~0ull,         \
> +       })
> +
> +#define __BF_FIELD_CHECK_REG(_mask, _reg, _pfx)
>          \
> +       ({                                                              \
> +               BUILD_BUG_ON_MSG((_mask) > (typeof(_reg))~0ULL,         \
>                                  _pfx "type of reg too small for mask"); \
> -               __BUILD_BUG_ON_NOT_POWER_OF_2((_mask) +                 \
> -                                             (1ULL << __bf_shf(_mask))); \
>         })
> 
>  /**
> @@ -64,7 +72,7 @@
>   */
>  #define FIELD_MAX(_mask)                                               \
>         ({                                                              \
> -               __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_MAX: ");     \
> +               __BF_FIELD_CHECK_MASK(_mask, "FIELD_MAX: ");            \
>                 (typeof(_mask))((_mask) >> __bf_shf(_mask));            \
>         })
> 
> @@ -77,7 +85,7 @@
>   */
>  #define FIELD_FIT(_mask, _val)                                         \
>         ({                                                              \
> -               __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: ");     \
> +               __BF_FIELD_CHECK_MASK(_mask, "FIELD_FIT: ");            \
>                 !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \
>         })
>  @@ -91,7 +99,8 @@
>   */
>  #define FIELD_PREP(_mask, _val)
>          \
>         ({                                                              \
> -               __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_PREP: ");    \
> +               __BF_FIELD_CHECK_MASK(_mask, "FIELD_PREP: ");           \
> +               __BF_FIELD_CHECK_VAL(_mask, _val, "FIELD_PREP: ");      \
>                 ((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask);   \
>         })
> 
> @@ -105,7 +114,8 @@
>   */
>  #define FIELD_GET(_mask, _reg)                                         \
>         ({                                                              \
> -               __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: ");       \
> +               __BF_FIELD_CHECK_MASK(_mask, "FIELD_GET: ");            \
> +               __BF_FIELD_CHECK_REG(_mask, _reg,  "FIELD_GET: ");      \
>                 (typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask)); \
>         })
> 
> 
> 
>>
>> That's all--just questions, I have no problem with the patch...
>>
>>                                         -Alex
>>
>>
>>
>>
>>> FIELD_FIT() should return true or false at runtime for whether a value
>>> can fit for not. Don't break the build over a value that's too large for
>>> the mask. We'd prefer to keep the inlining and compiler optimizations
>>> though we know this case will always return false.
>>>
>>> Cc: stable@vger.kernel.org
>>> Link: https://lore.kernel.org/kernel-hardening/CAK7LNASvb0UDJ0U5wkYYRzTAdnEs64HjXpEUL7d=V0CXiAXcNw@mail.gmail.com/
>>> Reported-by: Masahiro Yamada <masahiroy@kernel.org>
>>> Debugged-by: Sami Tolvanen <samitolvanen@google.com>
>>> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>>> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
>>> ---
>>>  include/linux/bitfield.h | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
>>> index 48ea093ff04c..4e035aca6f7e 100644
>>> --- a/include/linux/bitfield.h
>>> +++ b/include/linux/bitfield.h
>>> @@ -77,7 +77,7 @@
>>>   */
>>>  #define FIELD_FIT(_mask, _val)                                               \
>>>       ({                                                              \
>>> -             __BF_FIELD_CHECK(_mask, 0ULL, _val, "FIELD_FIT: ");     \
>>> +             __BF_FIELD_CHECK(_mask, 0ULL, 0ULL, "FIELD_FIT: ");     \
>>>               !((((typeof(_mask))_val) << __bf_shf(_mask)) & ~(_mask)); \
>>>       })
>>>
>>>
>>
> 
> 
> --
> Thanks,
> ~Nick Desaulniers
>