diff mbox series

[v2,09/17] lib/list_sort: fix function type mismatches

Message ID 20210318171111.706303-10-samitolvanen@google.com (mailing list archive)
State Superseded
Headers show
Series Add support for Clang CFI | expand

Commit Message

Sami Tolvanen March 18, 2021, 5:11 p.m. UTC
Casting the comparison function to a different type trips indirect
call Control-Flow Integrity (CFI) checking. Remove the additional
consts from cmp_func, and the now unneeded casts.

Fixes: 043b3f7b6388 ("lib/list_sort: simplify and remove MAX_LIST_LENGTH_BITS")
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
---
 lib/list_sort.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

Comments

Nick Desaulniers March 18, 2021, 6:31 p.m. UTC | #1
On Thu, Mar 18, 2021 at 10:11 AM Sami Tolvanen <samitolvanen@google.com> wrote:
>
> Casting the comparison function to a different type trips indirect
> call Control-Flow Integrity (CFI) checking. Remove the additional
> consts from cmp_func, and the now unneeded casts.
>
> Fixes: 043b3f7b6388 ("lib/list_sort: simplify and remove MAX_LIST_LENGTH_BITS")
> Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
> Reviewed-by: Kees Cook <keescook@chromium.org>
> ---
>  lib/list_sort.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/lib/list_sort.c b/lib/list_sort.c
> index 52f0c258c895..b14accf4ef83 100644
> --- a/lib/list_sort.c
> +++ b/lib/list_sort.c
> @@ -8,7 +8,7 @@
>  #include <linux/list.h>
>
>  typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
> -               struct list_head const *, struct list_head const *);
> +               struct list_head *, struct list_head *);
>
>  /*
>   * Returns a list organized in an intermediate format suited
> @@ -227,7 +227,7 @@ void list_sort(void *priv, struct list_head *head,

There's definitely some const confusion going on around here.
Comparison functions that modify their in/out parameters are a code
smell, and I wonder if any exist in tree?

I think it would be better to enforce one signature for cmp_func
throughout lib/list_sort.c and the tree, either const or not, but not
a mix of both.  I know `const` is messy because it tends to propagate
everywhere, so I don't care which is preferred (making cmp_func have
const qualified params or not, though if we're already being pedantic
about which params are non-null...), but something like this might be
nicer:

```
diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
index 5132f64a5cee..d475b3cfd06f 100644
--- a/block/blk-mq-sched.c
+++ b/block/blk-mq-sched.c
@@ -75,7 +75,8 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
        blk_mq_run_hw_queue(hctx, true);
 }

-static int sched_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int sched_rq_cmp(void *priv, const struct list_head *a,
+               const struct list_head *b)
 {
        struct request *rqa = container_of(a, struct request, queuelist);
        struct request *rqb = container_of(b, struct request, queuelist);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 2e825a7a3606..9ed063ffdb27 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1905,7 +1905,8 @@ void blk_mq_insert_requests(struct blk_mq_hw_ctx
*hctx, struct blk_mq_ctx *ctx,
        spin_unlock(&ctx->lock);
 }

-static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
+static int plug_rq_cmp(void *priv, const struct list_head *a,
+               const struct list_head *b)
 {
        struct request *rqa = container_of(a, struct request, queuelist);
        struct request *rqb = container_of(b, struct request, queuelist);
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 1ac67d4505e0..5a3a343499f6 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1290,7 +1290,8 @@ EXPORT_SYMBOL(drm_mode_prune_invalid);
  * Negative if @lh_a is better than @lh_b, zero if they're equivalent, or
  * positive if @lh_b is better than @lh_a.
  */
-static int drm_mode_compare(void *priv, struct list_head *lh_a,
struct list_head *lh_b)
+static int drm_mode_compare(void *priv, const struct list_head *lh_a,
+               const struct list_head *lh_b)
 {
        struct drm_display_mode *a = list_entry(lh_a, struct
drm_display_mode, head);
        struct drm_display_mode *b = list_entry(lh_b, struct
drm_display_mode, head);
diff --git a/drivers/gpu/drm/i915/gt/intel_engine_user.c
b/drivers/gpu/drm/i915/gt/intel_engine_user.c
index 34e6096f196e..7586dffd27d3 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_user.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_user.c
@@ -49,7 +49,8 @@ static const u8 uabi_classes[] = {
        [VIDEO_ENHANCEMENT_CLASS] = I915_ENGINE_CLASS_VIDEO_ENHANCE,
 };

-static int engine_cmp(void *priv, struct list_head *A, struct list_head *B)
+static int engine_cmp(void *priv, const struct list_head *A,
+               const struct list_head *B)
 {
        const struct intel_engine_cs *a =
                container_of((struct rb_node *)A, typeof(*a), uabi_node);
diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
index 4c2a9fe30067..4493ef0c715e 100644
--- a/fs/ext4/fsmap.c
+++ b/fs/ext4/fsmap.c
@@ -354,8 +354,8 @@ static unsigned int ext4_getfsmap_find_sb(struct
super_block *sb,

 /* Compare two fsmap items. */
 static int ext4_getfsmap_compare(void *priv,
-                                struct list_head *a,
-                                struct list_head *b)
+                                const struct list_head *a,
+                                const struct list_head *b)
 {
        struct ext4_fsmap *fa;
        struct ext4_fsmap *fb;
diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
index 414769a6ad11..0129e6bab985 100644
--- a/fs/iomap/buffered-io.c
+++ b/fs/iomap/buffered-io.c
@@ -1155,7 +1155,8 @@ iomap_ioend_try_merge(struct iomap_ioend *ioend,
struct list_head *more_ioends,
 EXPORT_SYMBOL_GPL(iomap_ioend_try_merge);

 static int
-iomap_ioend_compare(void *priv, struct list_head *a, struct list_head *b)
+iomap_ioend_compare(void *priv, const struct list_head *a,
+               const struct list_head *b)
 {
        struct iomap_ioend *ia = container_of(a, struct iomap_ioend, io_list);
        struct iomap_ioend *ib = container_of(b, struct iomap_ioend, io_list);
diff --git a/include/linux/list_sort.h b/include/linux/list_sort.h
index 20f178c24e9d..4fe9cb94d0d1 100644
--- a/include/linux/list_sort.h
+++ b/include/linux/list_sort.h
@@ -6,8 +6,9 @@

 struct list_head;

+typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
+               struct list_head const *, struct list_head const *);
+
 __attribute__((nonnull(2,3)))
-void list_sort(void *priv, struct list_head *head,
-              int (*cmp)(void *priv, struct list_head *a,
-                         struct list_head *b));
+void list_sort(void *priv, struct list_head *head, cmp_func cmp);
 #endif
diff --git a/lib/list_sort.c b/lib/list_sort.c
index 52f0c258c895..6cfac649c4a6 100644
--- a/lib/list_sort.c
+++ b/lib/list_sort.c
@@ -7,9 +7,6 @@
 #include <linux/list_sort.h>
 #include <linux/list.h>

-typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
-               struct list_head const *, struct list_head const *);
-
 /*
  * Returns a list organized in an intermediate format suited
  * to chaining of merge() calls: null-terminated, no reserved or
@@ -185,9 +182,7 @@ static void merge_final(void *priv, cmp_func cmp,
struct list_head *head,
  * 2^(k+1) - 1 (second merge of case 5 when x == 2^(k-1) - 1).
  */
 __attribute__((nonnull(2,3)))
-void list_sort(void *priv, struct list_head *head,
-               int (*cmp)(void *priv, struct list_head *a,
-                       struct list_head *b))
+void list_sort(void *priv, struct list_head *head, cmp_func cmp)
 {
        struct list_head *list = head->next, *pending = NULL;
        size_t count = 0;       /* Count of pending */
```
There are probably more instances in the tree to clean up, but that
compiles with x86_64 defconfig, and I'm sure it doesn't suffer the CFI
issue from the cast.

>                 if (likely(bits)) {
>                         struct list_head *a = *tail, *b = a->prev;
>
> -                       a = merge(priv, (cmp_func)cmp, b, a);
> +                       a = merge(priv, cmp, b, a);
>                         /* Install the merged result in place of the inputs */
>                         a->prev = b->prev;
>                         *tail = a;
> @@ -249,10 +249,10 @@ void list_sort(void *priv, struct list_head *head,
>
>                 if (!next)
>                         break;
> -               list = merge(priv, (cmp_func)cmp, pending, list);
> +               list = merge(priv, cmp, pending, list);
>                 pending = next;
>         }
>         /* The final merge, rebuilding prev links */
> -       merge_final(priv, (cmp_func)cmp, head, pending, list);
> +       merge_final(priv, cmp, head, pending, list);
>  }
>  EXPORT_SYMBOL(list_sort);
> --
> 2.31.0.291.g576ba9dcdaf-goog
>
Sami Tolvanen March 18, 2021, 9:31 p.m. UTC | #2
On Thu, Mar 18, 2021 at 11:31 AM Nick Desaulniers
<ndesaulniers@google.com> wrote:
>
> On Thu, Mar 18, 2021 at 10:11 AM Sami Tolvanen <samitolvanen@google.com> wrote:
> >
> > Casting the comparison function to a different type trips indirect
> > call Control-Flow Integrity (CFI) checking. Remove the additional
> > consts from cmp_func, and the now unneeded casts.
> >
> > Fixes: 043b3f7b6388 ("lib/list_sort: simplify and remove MAX_LIST_LENGTH_BITS")
> > Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
> > Reviewed-by: Kees Cook <keescook@chromium.org>
> > ---
> >  lib/list_sort.c | 8 ++++----
> >  1 file changed, 4 insertions(+), 4 deletions(-)
> >
> > diff --git a/lib/list_sort.c b/lib/list_sort.c
> > index 52f0c258c895..b14accf4ef83 100644
> > --- a/lib/list_sort.c
> > +++ b/lib/list_sort.c
> > @@ -8,7 +8,7 @@
> >  #include <linux/list.h>
> >
> >  typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
> > -               struct list_head const *, struct list_head const *);
> > +               struct list_head *, struct list_head *);
> >
> >  /*
> >   * Returns a list organized in an intermediate format suited
> > @@ -227,7 +227,7 @@ void list_sort(void *priv, struct list_head *head,
>
> There's definitely some const confusion going on around here.
> Comparison functions that modify their in/out parameters are a code
> smell, and I wonder if any exist in tree?
>
> I think it would be better to enforce one signature for cmp_func
> throughout lib/list_sort.c and the tree, either const or not, but not
> a mix of both.  I know `const` is messy because it tends to propagate
> everywhere, so I don't care which is preferred (making cmp_func have
> const qualified params or not, though if we're already being pedantic
> about which params are non-null...), but something like this might be
> nicer:

Sure, an alternative to removing the internal casts is to actually
change all the callers to use a comparison function with const
parameters. That's quite a bit more invasive, but I'm fine with that
approach too.

>
> ```
> diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
> index 5132f64a5cee..d475b3cfd06f 100644
> --- a/block/blk-mq-sched.c
> +++ b/block/blk-mq-sched.c
> @@ -75,7 +75,8 @@ void blk_mq_sched_restart(struct blk_mq_hw_ctx *hctx)
>         blk_mq_run_hw_queue(hctx, true);
>  }
>
> -static int sched_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
> +static int sched_rq_cmp(void *priv, const struct list_head *a,
> +               const struct list_head *b)
>  {
>         struct request *rqa = container_of(a, struct request, queuelist);
>         struct request *rqb = container_of(b, struct request, queuelist);
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index 2e825a7a3606..9ed063ffdb27 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -1905,7 +1905,8 @@ void blk_mq_insert_requests(struct blk_mq_hw_ctx
> *hctx, struct blk_mq_ctx *ctx,
>         spin_unlock(&ctx->lock);
>  }
>
> -static int plug_rq_cmp(void *priv, struct list_head *a, struct list_head *b)
> +static int plug_rq_cmp(void *priv, const struct list_head *a,
> +               const struct list_head *b)
>  {
>         struct request *rqa = container_of(a, struct request, queuelist);
>         struct request *rqb = container_of(b, struct request, queuelist);
> diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
> index 1ac67d4505e0..5a3a343499f6 100644
> --- a/drivers/gpu/drm/drm_modes.c
> +++ b/drivers/gpu/drm/drm_modes.c
> @@ -1290,7 +1290,8 @@ EXPORT_SYMBOL(drm_mode_prune_invalid);
>   * Negative if @lh_a is better than @lh_b, zero if they're equivalent, or
>   * positive if @lh_b is better than @lh_a.
>   */
> -static int drm_mode_compare(void *priv, struct list_head *lh_a,
> struct list_head *lh_b)
> +static int drm_mode_compare(void *priv, const struct list_head *lh_a,
> +               const struct list_head *lh_b)
>  {
>         struct drm_display_mode *a = list_entry(lh_a, struct
> drm_display_mode, head);
>         struct drm_display_mode *b = list_entry(lh_b, struct
> drm_display_mode, head);
> diff --git a/drivers/gpu/drm/i915/gt/intel_engine_user.c
> b/drivers/gpu/drm/i915/gt/intel_engine_user.c
> index 34e6096f196e..7586dffd27d3 100644
> --- a/drivers/gpu/drm/i915/gt/intel_engine_user.c
> +++ b/drivers/gpu/drm/i915/gt/intel_engine_user.c
> @@ -49,7 +49,8 @@ static const u8 uabi_classes[] = {
>         [VIDEO_ENHANCEMENT_CLASS] = I915_ENGINE_CLASS_VIDEO_ENHANCE,
>  };
>
> -static int engine_cmp(void *priv, struct list_head *A, struct list_head *B)
> +static int engine_cmp(void *priv, const struct list_head *A,
> +               const struct list_head *B)
>  {
>         const struct intel_engine_cs *a =
>                 container_of((struct rb_node *)A, typeof(*a), uabi_node);
> diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
> index 4c2a9fe30067..4493ef0c715e 100644
> --- a/fs/ext4/fsmap.c
> +++ b/fs/ext4/fsmap.c
> @@ -354,8 +354,8 @@ static unsigned int ext4_getfsmap_find_sb(struct
> super_block *sb,
>
>  /* Compare two fsmap items. */
>  static int ext4_getfsmap_compare(void *priv,
> -                                struct list_head *a,
> -                                struct list_head *b)
> +                                const struct list_head *a,
> +                                const struct list_head *b)
>  {
>         struct ext4_fsmap *fa;
>         struct ext4_fsmap *fb;
> diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c
> index 414769a6ad11..0129e6bab985 100644
> --- a/fs/iomap/buffered-io.c
> +++ b/fs/iomap/buffered-io.c
> @@ -1155,7 +1155,8 @@ iomap_ioend_try_merge(struct iomap_ioend *ioend,
> struct list_head *more_ioends,
>  EXPORT_SYMBOL_GPL(iomap_ioend_try_merge);
>
>  static int
> -iomap_ioend_compare(void *priv, struct list_head *a, struct list_head *b)
> +iomap_ioend_compare(void *priv, const struct list_head *a,
> +               const struct list_head *b)
>  {
>         struct iomap_ioend *ia = container_of(a, struct iomap_ioend, io_list);
>         struct iomap_ioend *ib = container_of(b, struct iomap_ioend, io_list);
> diff --git a/include/linux/list_sort.h b/include/linux/list_sort.h
> index 20f178c24e9d..4fe9cb94d0d1 100644
> --- a/include/linux/list_sort.h
> +++ b/include/linux/list_sort.h
> @@ -6,8 +6,9 @@
>
>  struct list_head;
>
> +typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
> +               struct list_head const *, struct list_head const *);
> +

Note that we already have cmp_func_t in linux/types.h, so something
like list_cmp_func_t would probably be more appropriate here.

>  __attribute__((nonnull(2,3)))
> -void list_sort(void *priv, struct list_head *head,
> -              int (*cmp)(void *priv, struct list_head *a,
> -                         struct list_head *b));
> +void list_sort(void *priv, struct list_head *head, cmp_func cmp);
>  #endif
> diff --git a/lib/list_sort.c b/lib/list_sort.c
> index 52f0c258c895..6cfac649c4a6 100644
> --- a/lib/list_sort.c
> +++ b/lib/list_sort.c
> @@ -7,9 +7,6 @@
>  #include <linux/list_sort.h>
>  #include <linux/list.h>
>
> -typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
> -               struct list_head const *, struct list_head const *);
> -
>  /*
>   * Returns a list organized in an intermediate format suited
>   * to chaining of merge() calls: null-terminated, no reserved or
> @@ -185,9 +182,7 @@ static void merge_final(void *priv, cmp_func cmp,
> struct list_head *head,
>   * 2^(k+1) - 1 (second merge of case 5 when x == 2^(k-1) - 1).
>   */
>  __attribute__((nonnull(2,3)))
> -void list_sort(void *priv, struct list_head *head,
> -               int (*cmp)(void *priv, struct list_head *a,
> -                       struct list_head *b))
> +void list_sort(void *priv, struct list_head *head, cmp_func cmp)
>  {
>         struct list_head *list = head->next, *pending = NULL;
>         size_t count = 0;       /* Count of pending */
> ```
> There are probably more instances in the tree to clean up, but that
> compiles with x86_64 defconfig, and I'm sure it doesn't suffer the CFI
> issue from the cast.

You indeed missed some callers, but after fixing all the remaining
ones too, arm64 and x86_64 allyesconfigs still seem to build just fine
for me:

 arch/arm64/kvm/vgic/vgic-its.c                         |    8 ++++----
 arch/arm64/kvm/vgic/vgic.c                             |    2 +-
 block/blk-mq-sched.c                                   |    2 +-
 block/blk-mq.c                                         |    2 +-
 drivers/acpi/nfit/core.c                               |    2 +-
 drivers/acpi/numa/hmat.c                               |    2 +-
 drivers/clk/keystone/sci-clk.c                         |    4 ++--
 drivers/gpu/drm/drm_modes.c                            |    2 +-
 drivers/gpu/drm/i915/gt/intel_engine_user.c            |    2 +-
 drivers/gpu/drm/i915/gvt/debugfs.c                     |    2 +-
 drivers/gpu/drm/i915/selftests/i915_gem_gtt.c          |    2 +-
 drivers/gpu/drm/radeon/radeon_cs.c                     |    4 ++--
 drivers/infiniband/hw/usnic/usnic_uiom_interval_tree.c |    2 +-
 drivers/interconnect/qcom/bcm-voter.c                  |    2 +-
 drivers/md/raid5.c                                     |    2 +-
 drivers/misc/sram.c                                    |    4 ++--
 drivers/nvme/host/core.c                               |    2 +-
 drivers/pci/controller/cadence/pcie-cadence-host.c     |    3 ++-
 drivers/spi/spi-loopback-test.c                        |    2 +-
 fs/btrfs/raid56.c                                      |    2 +-
 fs/btrfs/tree-log.c                                    |    2 +-
 fs/btrfs/volumes.c                                     |    2 +-
 fs/ext4/fsmap.c                                        |    4 ++--
 fs/gfs2/glock.c                                        |    2 +-
 fs/gfs2/log.c                                          |    2 +-
 fs/gfs2/lops.c                                         |    2 +-
 fs/iomap/buffered-io.c                                 |    2 +-
 fs/ubifs/gc.c                                          |    6 +++---
 fs/ubifs/replay.c                                      |    4 ++--
 fs/xfs/scrub/bitmap.c                                  |    4 ++--
 fs/xfs/xfs_bmap_item.c                                 |    4 ++--
 fs/xfs/xfs_buf.c                                       |    4 ++--
 fs/xfs/xfs_extent_busy.c                               |    4 ++--
 fs/xfs/xfs_extent_busy.h                               |    2 +-
 fs/xfs/xfs_extfree_item.c                              |    4 ++--
 fs/xfs/xfs_refcount_item.c                             |    4 ++--
 fs/xfs/xfs_rmap_item.c                                 |    4 ++--
 include/linux/list_sort.h                              |    7 ++++---
 lib/list_sort.c                                        |   17 ++++++-----------
 lib/test_list_sort.c                                   |    2 +-
 net/tipc/name_table.c                                  |    4 ++--
 41 files changed, 68 insertions(+), 71 deletions(-)

I'll have to double check that all the affected code is actually
included in these builds, but if nobody objects and I don't run into
any issues, I'll include the patch in v3.

Sami
diff mbox series

Patch

diff --git a/lib/list_sort.c b/lib/list_sort.c
index 52f0c258c895..b14accf4ef83 100644
--- a/lib/list_sort.c
+++ b/lib/list_sort.c
@@ -8,7 +8,7 @@ 
 #include <linux/list.h>
 
 typedef int __attribute__((nonnull(2,3))) (*cmp_func)(void *,
-		struct list_head const *, struct list_head const *);
+		struct list_head *, struct list_head *);
 
 /*
  * Returns a list organized in an intermediate format suited
@@ -227,7 +227,7 @@  void list_sort(void *priv, struct list_head *head,
 		if (likely(bits)) {
 			struct list_head *a = *tail, *b = a->prev;
 
-			a = merge(priv, (cmp_func)cmp, b, a);
+			a = merge(priv, cmp, b, a);
 			/* Install the merged result in place of the inputs */
 			a->prev = b->prev;
 			*tail = a;
@@ -249,10 +249,10 @@  void list_sort(void *priv, struct list_head *head,
 
 		if (!next)
 			break;
-		list = merge(priv, (cmp_func)cmp, pending, list);
+		list = merge(priv, cmp, pending, list);
 		pending = next;
 	}
 	/* The final merge, rebuilding prev links */
-	merge_final(priv, (cmp_func)cmp, head, pending, list);
+	merge_final(priv, cmp, head, pending, list);
 }
 EXPORT_SYMBOL(list_sort);