From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.6 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E094DC55ABD for ; Tue, 10 Nov 2020 18:43:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 824D8206F1 for ; Tue, 10 Nov 2020 18:43:09 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Akbtt04u" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731472AbgKJSnI (ORCPT ); Tue, 10 Nov 2020 13:43:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725862AbgKJSnE (ORCPT ); Tue, 10 Nov 2020 13:43:04 -0500 Received: from mail-yb1-xb41.google.com (mail-yb1-xb41.google.com [IPv6:2607:f8b0:4864:20::b41]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7007FC0613D1; Tue, 10 Nov 2020 10:43:04 -0800 (PST) Received: by mail-yb1-xb41.google.com with SMTP id s8so12576563yba.13; Tue, 10 Nov 2020 10:43:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oOeFUNM4jhGqbawcUIauzPQF7fQF7Oz58AeNbXhLGQQ=; b=Akbtt04ubbIMlw8fPNnZFiGcd4HWgJ85/0qMrauXJB+xPCHlzIzo/DMDO63ktPEWG3 T0YZYD8KL589ofpUbK+liXUChLeA1fd/XDiK0Sra29yQlrJ6JANNalpXv5i0woB6M4lL Bb5pOL/VypPyQiwO5MbjWHMyWlbz7n6gGIi+8fI+yYWQrBuEAReL+cYGQK77O8u8T4mS Ca7KGRYQs5/1+cj5iwrizjM6iGkXJ5t9yrQDqyVbQvFmYDdinYhGAJOGudc6dfJFa846 RxnRZWxZ0C2mvxlo78l1DPU2mBTNvYGJ1SW0e2sLGXArEgfSQxo48zAfRzkTYuCVfJUm Kb6g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oOeFUNM4jhGqbawcUIauzPQF7fQF7Oz58AeNbXhLGQQ=; b=fALw/d3X2FiUEPUT6cbasbWeh9Q7QVI34s+CBLCWCD3BrF0BrsuUxCUGsJClMhpToV Fowzj46fRtaY/kObZ+IRWQCcbnGAaceheFzU681E1L5X+XPmDDCJ44AR74rg9ei14F/6 Zr4anCKwuRVK9HzASFVYHcIU0tcmm5SG5LvXaM6C6G68cAFfpz4/au32nRd2WasCuBDJ huRZz5wcdn+1m409XhNkz/uD3XGXcH41ljrlckgmRooYs20btmT23xP1X7yqrKcL7o4l 96Kx1wuMUNj8HM06Wr4Xx7tyob9hf3wWIBVxZdJpyyJUcUwtKyKIjEeq/2nNuIT7mn8z dWGg== X-Gm-Message-State: AOAM5337+It4BJ69wqp9Kt3p0ucHRG9ulRtX3VYIi70fTWOoij1jiq+H JdLHouwoWyjdmWuPNHYWCTEXtybnx1don9bGQJc= X-Google-Smtp-Source: ABdhPJzVPiwV63wNDRTuUhDdqwq6L62tcBKnJWGqscHiR4DI4J2xPusXe22uaLSMlP+Ju2baNL7nJkYUAelv0p1I5W4= X-Received: by 2002:a25:585:: with SMTP id 127mr17284941ybf.425.1605033783761; Tue, 10 Nov 2020 10:43:03 -0800 (PST) MIME-Version: 1.0 References: <1605009019-22310-1-git-send-email-kaixuxia@tencent.com> In-Reply-To: From: Andrii Nakryiko Date: Tue, 10 Nov 2020 10:42:53 -0800 Message-ID: Subject: Re: [PATCH] bpf: Fix unsigned 'datasec_id' compared with zero in check_pseudo_btf_id To: Denis Kirjanov Cc: xiakaixu1987@gmail.com, Alexei Starovoitov , Daniel Borkmann , Martin Lau , Song Liu , Yonghong Song , Andrii Nakryiko , john fastabend , KP Singh , Networking , bpf , open list , Kaixu Xia Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Nov 10, 2020 at 5:02 AM Denis Kirjanov wrote: > > On 11/10/20, xiakaixu1987@gmail.com wrote: > > From: Kaixu Xia > > > > The unsigned variable datasec_id is assigned a return value from the call > > to check_pseudo_btf_id(), which may return negative error code. > > > > Fixes coccicheck warning: > > > > ./kernel/bpf/verifier.c:9616:5-15: WARNING: Unsigned expression compared > > with zero: datasec_id > 0 > > > > Reported-by: Tosk Robot > > Signed-off-by: Kaixu Xia > > --- > > kernel/bpf/verifier.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > index 6200519582a6..e9d8d4309bb4 100644 > > --- a/kernel/bpf/verifier.c > > +++ b/kernel/bpf/verifier.c > > @@ -9572,7 +9572,7 @@ static int check_pseudo_btf_id(struct bpf_verifier_env > > *env, > > struct bpf_insn *insn, > > struct bpf_insn_aux_data *aux) > > { > > - u32 datasec_id, type, id = insn->imm; > > + s32 datasec_id, type, id = insn->imm; > > but the value is passed as u32 to btf_type_by_id()... > > btf_find_by_name_kind() returns s32 Right, valid range of BTF type IDs are >= 0 and (significantly) less than INT_MAX. So s32 is used to signal valid BTF ID or negative error, but all the APIs accepting BTF ID accept it as just u32. > > > > const struct btf_var_secinfo *vsi; > > const struct btf_type *datasec; > > const struct btf_type *t; > > -- > > 2.20.0 > > > >