From nobody Sat Jan 3 06:31:39 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16878E7B60F for ; Wed, 4 Oct 2023 13:19:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242610AbjJDNTt (ORCPT ); Wed, 4 Oct 2023 09:19:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55718 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233096AbjJDNTr (ORCPT ); Wed, 4 Oct 2023 09:19:47 -0400 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A7E3298 for ; Wed, 4 Oct 2023 06:19:44 -0700 (PDT) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39850C433C7; Wed, 4 Oct 2023 13:19:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1696425584; bh=bhclEsddtPiCxtYvFgBUs63/P/GoHLqamR5MHHrkOGs=; h=Date:From:To:Cc:Subject:From; b=eVTuL3hok71ptrABuk/GXY5dSnBMUIKIyxTpnstpH8KlEo3/1n+GA9pCZ+P8NioaB psPOxIbZ4ATGY7Rje6IKtCBcGebBP9mM1GJVfeEgXh2L3epgTG+wZAa5HF14Wh4VZV HMriNU1ynrdrLKC6RMJY8C3llX6ylefeuA0w03lNzJtERXE87MbWAz4NPMlrOURBqP 64Cu/tLWsjFM+6kC2Nber7j6EwoCpYrYdqCYTYp5cmWJSpn+fAi6vZT8KCxfGDD+gG PMH0Lkdi59RLj9f8MAJ9hx2l919azOpWDb4JNwBZ+WyVLihiNDpEWosfqgkY6f7SVd k0m7kvHd+8zLw== Date: Wed, 4 Oct 2023 15:19:37 +0200 From: "Gustavo A. R. Silva" To: Jamal Hadi Salim , Cong Wang , Jiri Pirko , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , "Gustavo A. R. Silva" Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Gustavo A. R. Silva" , linux-hardening@vger.kernel.org, Kees Cook Subject: [PATCH v2] net: sched: cls_u32: Fix allocation size in u32_init() Message-ID: MIME-Version: 1.0 Content-Disposition: inline Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" commit d61491a51f7e ("net/sched: cls_u32: Replace one-element array with flexible-array member") incorrecly replaced an instance of `sizeof(*tp_c)` with `struct_size(tp_c, hlist->ht, 1)`. This results in a an over-allocation of 8 bytes. This change is wrong because `hlist` in `struct tc_u_common` is a pointer: net/sched/cls_u32.c: struct tc_u_common { struct tc_u_hnode __rcu *hlist; void *ptr; int refcnt; struct idr handle_idr; struct hlist_node hnode; long knodes; }; So, the use of `struct_size()` makes no sense: we don't need to allocate any extra space for a flexible-array member. `sizeof(*tp_c)` is just fine. So, `struct_size(tp_c, hlist->ht, 1)` translates to: sizeof(*tp_c) + sizeof(tp_c->hlist->ht) =3D=3D sizeof(struct tc_u_common) + sizeof(struct tc_u_knode *) =3D=3D 144 + 8 =3D=3D 0x98 (byes) ^^^ | unnecessary extra allocation size $ pahole -C tc_u_common net/sched/cls_u32.o struct tc_u_common { struct tc_u_hnode * hlist; /* 0 8 */ void * ptr; /* 8 8 */ int refcnt; /* 16 4 */ /* XXX 4 bytes hole, try to pack */ struct idr handle_idr; /* 24 96 */ /* --- cacheline 1 boundary (64 bytes) was 56 bytes ago --- */ struct hlist_node hnode; /* 120 16 */ /* --- cacheline 2 boundary (128 bytes) was 8 bytes ago --- */ long int knodes; /* 136 8 */ /* size: 144, cachelines: 3, members: 6 */ /* sum members: 140, holes: 1, sum holes: 4 */ /* last cacheline: 16 bytes */ }; And with `sizeof(*tp_c)`, we have: sizeof(*tp_c) =3D=3D sizeof(struct tc_u_common) =3D=3D 144 =3D=3D 0x90 (by= tes) which is the correct and original allocation size. Fix this issue by replacing `struct_size(tp_c, hlist->ht, 1)` with `sizeof(*tp_c)`, and avoid allocating 8 too many bytes. The following difference in binary output is expected and reflects the desired change: | net/sched/cls_u32.o | @@ -6148,7 +6148,7 @@ | include/linux/slab.h:599 | 2cf5: mov 0x0(%rip),%rdi # 2cfc | 2cf8: R_X86_64_PC32 kmalloc_caches+0xc |- 2cfc: mov $0x98,%edx |+ 2cfc: mov $0x90,%edx Reported-by: Alejandro Colomar Closes: https://lore.kernel.org/lkml/09b4a2ce-da74-3a19-6961-67883f634d98@k= ernel.org/ Signed-off-by: Gustavo A. R. Silva Acked-by: Jamal Hadi Salim --- Changes in v2: - Update subject line. - Update changelog text. v1: - Link: https://lore.kernel.org/linux-hardening/ZN5DvRyq6JNz20l1@work/ net/sched/cls_u32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index da4c179a4d41..6663e971a13e 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -366,7 +366,7 @@ static int u32_init(struct tcf_proto *tp) idr_init(&root_ht->handle_idr); =20 if (tp_c =3D=3D NULL) { - tp_c =3D kzalloc(struct_size(tp_c, hlist->ht, 1), GFP_KERNEL); + tp_c =3D kzalloc(sizeof(*tp_c), GFP_KERNEL); if (tp_c =3D=3D NULL) { kfree(root_ht); return -ENOBUFS; --=20 2.34.1