arena_base() casts the map definition to the kernel's struct bpf_arena and reads user_vm_start out of it. In the object file that definition is only the 32-byte BTF placeholder the loader rewrites, so the access is past the end of the object which GCC correctly complaints about and due to -Werror leads to build failure: libarena/include/bpf_arena_common.h:52:69: error: array subscript 'struct bpf_arena[0]' is partly outside array bounds of 'struct [1]' [-Werror=array-bounds=] 52 | #define arena_base(map) ((void __arena *)((struct bpf_arena *)(map))->user_vm_start) progs/arena_race.c:58:30: note: in expansion of macro 'arena_base' progs/stream.c already solved this for its own open-coded copy of the access, with barrier_var(), for both the compilers. Do the same in arena_base() itself so all such uses are fixed. No test changes verdict; this only lets the objects build. Signed-off-by: Vineet Gupta --- v3 -> v4: was 4/8. barrier_var() for both compilers rather than behind #ifdef __clang__, and stream.c's five open-coded copies of the access fold back into the macro. (Alexei) .../bpf/libarena/include/bpf_arena_common.h | 11 +++- tools/testing/selftests/bpf/progs/stream.c | 56 +++---------------- 2 files changed, 18 insertions(+), 49 deletions(-) diff --git a/tools/testing/selftests/bpf/libarena/include/bpf_arena_common.h b/tools/testing/selftests/bpf/libarena/include/bpf_arena_common.h index 82aafe879fae..0eba52961405 100644 --- a/tools/testing/selftests/bpf/libarena/include/bpf_arena_common.h +++ b/tools/testing/selftests/bpf/libarena/include/bpf_arena_common.h @@ -49,7 +49,16 @@ void __arena* bpf_arena_alloc_pages(void *map, void __arena *addr, __u32 page_cn int bpf_arena_reserve_pages(void *map, void __arena *addr, __u32 page_cnt) __ksym __weak; void bpf_arena_free_pages(void *map, void __arena *ptr, __u32 page_cnt) __ksym __weak; -#define arena_base(map) ((void __arena *)((struct bpf_arena *)(map))->user_vm_start) +/* + * The map definition is smaller than struct bpf_arena. + * barrier_var() hides that from -Warray-bounds of GCC. + */ +#define arena_base(map) \ + ({ \ + struct bpf_arena *___arena = (void *)(map); \ + barrier_var(___arena); \ + (void __arena *)___arena->user_vm_start; \ + }) #else /* when compiled as user space code */ diff --git a/tools/testing/selftests/bpf/progs/stream.c b/tools/testing/selftests/bpf/progs/stream.c index 1ae015c4e6b4..b4d88d0e01ad 100644 --- a/tools/testing/selftests/bpf/progs/stream.c +++ b/tools/testing/selftests/bpf/progs/stream.c @@ -178,16 +178,8 @@ __stderr("Call trace:\n" "|[ \t]+[^\n]+\n)*}}") int stream_arena_write_fault(void *ctx) { - struct bpf_arena *ptr = (void *)&arena; - u64 user_vm_start; + u64 user_vm_start = (u64)arena_base(&arena); - /* Prevent GCC bounds warning: casting &arena to struct bpf_arena * - * triggers bounds checking since the map definition is smaller than struct - * bpf_arena. barrier_var() makes the pointer opaque to GCC, preventing the - * bounds analysis - */ - barrier_var(ptr); - user_vm_start = ptr->user_vm_start; fault_addr = user_vm_start + 0x7fff; bpf_addr_space_cast(user_vm_start, 0, 1); asm volatile ( @@ -212,16 +204,8 @@ __stderr("Call trace:\n" "|[ \t]+[^\n]+\n)*}}") int stream_arena_read_fault(void *ctx) { - struct bpf_arena *ptr = (void *)&arena; - u64 user_vm_start; + u64 user_vm_start = (u64)arena_base(&arena); - /* Prevent GCC bounds warning: casting &arena to struct bpf_arena * - * triggers bounds checking since the map definition is smaller than struct - * bpf_arena. barrier_var() makes the pointer opaque to GCC, preventing the - * bounds analysis - */ - barrier_var(ptr); - user_vm_start = ptr->user_vm_start; fault_addr = user_vm_start + 0x7fff; bpf_addr_space_cast(user_vm_start, 0, 1); asm volatile ( @@ -252,17 +236,9 @@ int stream_arena_load_acquire_fault(void *ctx) .off = 0x7fff, .imm = 0x100, /* BPF_LOAD_ACQ */ }; - struct bpf_arena *ptr = (void *)&arena; - u64 user_vm_start, val; + u64 user_vm_start = (u64)arena_base(&arena); + u64 val; - /* - * Prevent GCC bounds warning: casting &arena to struct bpf_arena * - * triggers bounds checking since the map definition is smaller than - * struct bpf_arena. barrier_var() makes the pointer opaque to GCC, - * preventing the bounds analysis. - */ - barrier_var(ptr); - user_vm_start = ptr->user_vm_start; fault_addr = user_vm_start + 0x7fff; bpf_addr_space_cast(user_vm_start, 0, 1); asm volatile ( @@ -296,17 +272,9 @@ int stream_arena_xchg_fault(void *ctx) .off = 0x7fff, .imm = 0xe1, /* BPF_XCHG */ }; - struct bpf_arena *ptr = (void *)&arena; - u64 user_vm_start, val; + u64 user_vm_start = (u64)arena_base(&arena); + u64 val; - /* - * Prevent GCC bounds warning: casting &arena to struct bpf_arena * - * triggers bounds checking since the map definition is smaller than - * struct bpf_arena. barrier_var() makes the pointer opaque to GCC, - * preventing the bounds analysis. - */ - barrier_var(ptr); - user_vm_start = ptr->user_vm_start; fault_addr = user_vm_start + 0x7fff; bpf_addr_space_cast(user_vm_start, 0, 1); /* @@ -346,17 +314,9 @@ int stream_arena_cmpxchg_fault(void *ctx) .off = 0x7fff, .imm = 0xf1, /* BPF_CMPXCHG */ }; - struct bpf_arena *ptr = (void *)&arena; - u64 user_vm_start, val; + u64 user_vm_start = (u64)arena_base(&arena); + u64 val; - /* - * Prevent GCC bounds warning: casting &arena to struct bpf_arena * - * triggers bounds checking since the map definition is smaller than - * struct bpf_arena. barrier_var() makes the pointer opaque to GCC, - * preventing the bounds analysis. - */ - barrier_var(ptr); - user_vm_start = ptr->user_vm_start; fault_addr = user_vm_start + 0x7fff; bpf_addr_space_cast(user_vm_start, 0, 1); /* -- 2.53.0-Meta