| Message ID | 20231213165741.93528-1-jhs@mojatatu.com (mailing list archive) |
|---|---|
| State | Rejected |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,1/1] net_sched: sch_fq: Fix out of range band computation | expand |
On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > It is possible to compute a band of 3. Doing so will overrun array > q->band_pkt_count[0-2] boundaries. > > Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") > Reported-by: Coverity Scan <scan-admin@coverity.com> > Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> > --- > net/sched/sch_fq.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c > index 3a31c47fea9b..217c430343df 100644 > --- a/net/sched/sch_fq.c > +++ b/net/sched/sch_fq.c > @@ -159,7 +159,7 @@ struct fq_sched_data { > /* return the i-th 2-bit value ("crumb") */ > static u8 fq_prio2band(const u8 *prio2band, unsigned int prio) > { > - return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3; > + return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3; > } > Are you sure this is needed ? fq_load_priomap() makes sure this can not happen...
On Wed, Dec 13, 2023 at 12:30 PM Eric Dumazet <edumazet@google.com> wrote: > > On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > > > It is possible to compute a band of 3. Doing so will overrun array > > q->band_pkt_count[0-2] boundaries. > > > > Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") > > Reported-by: Coverity Scan <scan-admin@coverity.com> > > Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> > > --- > > net/sched/sch_fq.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c > > index 3a31c47fea9b..217c430343df 100644 > > --- a/net/sched/sch_fq.c > > +++ b/net/sched/sch_fq.c > > @@ -159,7 +159,7 @@ struct fq_sched_data { > > /* return the i-th 2-bit value ("crumb") */ > > static u8 fq_prio2band(const u8 *prio2band, unsigned int prio) > > { > > - return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3; > > + return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3; > > } > > > > Are you sure this is needed ? > According to coverity static analysis. > fq_load_priomap() makes sure this can not happen... True. Sounds like a false positive because coverity sees the masking with &0x3 and assumes we could get a result of 3. cheers, jamal
On Wed, Dec 13, 2023 at 6:29 PM Eric Dumazet <edumazet@google.com> wrote: > > On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > > > It is possible to compute a band of 3. Doing so will overrun array > > q->band_pkt_count[0-2] boundaries. > > > > Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") > > Reported-by: Coverity Scan <scan-admin@coverity.com> > > Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> > > --- > > net/sched/sch_fq.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c > > index 3a31c47fea9b..217c430343df 100644 > > --- a/net/sched/sch_fq.c > > +++ b/net/sched/sch_fq.c > > @@ -159,7 +159,7 @@ struct fq_sched_data { > > /* return the i-th 2-bit value ("crumb") */ > > static u8 fq_prio2band(const u8 *prio2band, unsigned int prio) > > { > > - return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3; > > + return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3; > > } > > > > Are you sure this is needed ? > > fq_load_priomap() makes sure this can not happen... Yeah, I am pretty sure this patch is incorrect, we need to mask to get only two bits.
On Wed, Dec 13, 2023 at 12:42 PM Eric Dumazet <edumazet@google.com> wrote: > > On Wed, Dec 13, 2023 at 6:29 PM Eric Dumazet <edumazet@google.com> wrote: > > > > On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > > > > > It is possible to compute a band of 3. Doing so will overrun array > > > q->band_pkt_count[0-2] boundaries. > > > > > > Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") > > > Reported-by: Coverity Scan <scan-admin@coverity.com> > > > Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> > > > --- > > > net/sched/sch_fq.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c > > > index 3a31c47fea9b..217c430343df 100644 > > > --- a/net/sched/sch_fq.c > > > +++ b/net/sched/sch_fq.c > > > @@ -159,7 +159,7 @@ struct fq_sched_data { > > > /* return the i-th 2-bit value ("crumb") */ > > > static u8 fq_prio2band(const u8 *prio2band, unsigned int prio) > > > { > > > - return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3; > > > + return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3; > > > } > > > > > > > Are you sure this is needed ? > > > > fq_load_priomap() makes sure this can not happen... > > Yeah, I am pretty sure this patch is incorrect, we need to mask to get > only two bits. The check in fq_load_priomap() is what makes it moot. Masking with b'11 could result in b'11. Definitely the modulo will guarantee whatever results can only be in the range 0..2. But it is not needed. cheers, jamal
On Wed, Dec 13, 2023 at 6:53 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > On Wed, Dec 13, 2023 at 12:42 PM Eric Dumazet <edumazet@google.com> wrote: > > > > On Wed, Dec 13, 2023 at 6:29 PM Eric Dumazet <edumazet@google.com> wrote: > > > > > > On Wed, Dec 13, 2023 at 5:57 PM Jamal Hadi Salim <jhs@mojatatu.com> wrote: > > > > > > > > It is possible to compute a band of 3. Doing so will overrun array > > > > q->band_pkt_count[0-2] boundaries. > > > > > > > > Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") > > > > Reported-by: Coverity Scan <scan-admin@coverity.com> > > > > Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> > > > > --- > > > > net/sched/sch_fq.c | 2 +- > > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > > > diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c > > > > index 3a31c47fea9b..217c430343df 100644 > > > > --- a/net/sched/sch_fq.c > > > > +++ b/net/sched/sch_fq.c > > > > @@ -159,7 +159,7 @@ struct fq_sched_data { > > > > /* return the i-th 2-bit value ("crumb") */ > > > > static u8 fq_prio2band(const u8 *prio2band, unsigned int prio) > > > > { > > > > - return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3; > > > > + return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3; > > > > } > > > > > > > > > > Are you sure this is needed ? > > > > > > fq_load_priomap() makes sure this can not happen... > > > > Yeah, I am pretty sure this patch is incorrect, we need to mask to get > > only two bits. > > The check in fq_load_priomap() is what makes it moot. Masking with > b'11 could result in b'11. Definitely the modulo will guarantee > whatever results can only be in the range 0..2. But it is not needed. > > Modulo would be incorrect, since it would use high order bits. (0x22 % 3) is different than (0x22 & 3) Had you written: return ((prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3) % 3) Then yes, the last % 3 would be "not needed"
diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c index 3a31c47fea9b..217c430343df 100644 --- a/net/sched/sch_fq.c +++ b/net/sched/sch_fq.c @@ -159,7 +159,7 @@ struct fq_sched_data { /* return the i-th 2-bit value ("crumb") */ static u8 fq_prio2band(const u8 *prio2band, unsigned int prio) { - return (prio2band[prio / 4] >> (2 * (prio & 0x3))) & 0x3; + return (prio2band[prio / 4] >> (2 * (prio & 0x3))) % 0x3; } /*
It is possible to compute a band of 3. Doing so will overrun array q->band_pkt_count[0-2] boundaries. Fixes: 29f834aa326e ("net_sched: sch_fq: add 3 bands and WRR scheduling") Reported-by: Coverity Scan <scan-admin@coverity.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> --- net/sched/sch_fq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)