[Devel] [PATCH RHEL9 COMMIT] ms/skbuff: Extract list pointers to silence compiler warnings

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.0-284.11.1.vz9.25.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh9-5.14.0-284.11.1.el9
------>
commit 80fb4fc5c303c94a0e565ef9b13fe664d3e3bcdb
Author: Kees Cook <keescook at chromium.org>
Date:   Mon Dec 6 22:27:58 2021 -0800

    ms/skbuff: Extract list pointers to silence compiler warnings
    
    Under both -Warray-bounds and the object_size sanitizer, the compiler is
    upset about accessing prev/next of sk_buff when the object it thinks it
    is coming from is sk_buff_head. The warning is a false positive due to
    the compiler taking a conservative approach, opting to warn at casting
    time rather than access time.
    
    However, in support of enabling -Warray-bounds globally (which has
    found many real bugs), arrange things for sk_buff so that the compiler
    can unambiguously see that there is no intention to access anything
    except prev/next.  Introduce and cast to a separate struct sk_buff_list,
    which contains _only_ the first two fields, silencing the warnings:
    
    In file included from ./include/net/net_namespace.h:39,
                     from ./include/linux/netdevice.h:37,
                     from net/core/netpoll.c:17:
    net/core/netpoll.c: In function 'refill_skbs':
    ./include/linux/skbuff.h:2086:9: warning: array subscript 'struct sk_buff[0]' is partly outside array bounds of 'struct sk_buff_head[1]' [-Warray-bounds]
     2086 |         __skb_insert(newsk, next->prev, next, list);
          |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    net/core/netpoll.c:49:28: note: while referencing 'skb_pool'
       49 | static struct sk_buff_head skb_pool;
          |                            ^~~~~~~~
    
    This change results in no executable instruction differences.
    
    Signed-off-by: Kees Cook <keescook at chromium.org>
    Link: https://lore.kernel.org/r/20211207062758.2324338-1-keescook@chromium.org
    Signed-off-by: Jakub Kicinski <kuba at kernel.org>
    
    (cherry picked from ms commit 1a2fb220edca98d18f90e3ef5bd6853a6b22b1b8)
    Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
    
    Feature: fix ms/sock
---
 include/linux/skbuff.h | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 5d9b35ff4720..2463e078e54a 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -296,9 +296,11 @@ struct tc_skb_ext {
 #endif
 
 struct sk_buff_head {
-	/* These two members must be first. */
-	struct sk_buff	*next;
-	struct sk_buff	*prev;
+	/* These two members must be first to match sk_buff. */
+	struct_group_tagged(sk_buff_list, list,
+		struct sk_buff	*next;
+		struct sk_buff	*prev;
+	);
 
 	__u32		qlen;
 	spinlock_t	lock;
@@ -733,7 +735,7 @@ typedef unsigned char *sk_buff_data_t;
 struct sk_buff {
 	union {
 		struct {
-			/* These two members must be first. */
+			/* These two members must be first to match sk_buff_head. */
 			struct sk_buff		*next;
 			struct sk_buff		*prev;
 
@@ -2002,8 +2004,8 @@ static inline void __skb_insert(struct sk_buff *newsk,
 	 */
 	WRITE_ONCE(newsk->next, next);
 	WRITE_ONCE(newsk->prev, prev);
-	WRITE_ONCE(next->prev, newsk);
-	WRITE_ONCE(prev->next, newsk);
+	WRITE_ONCE(((struct sk_buff_list *)next)->prev, newsk);
+	WRITE_ONCE(((struct sk_buff_list *)prev)->next, newsk);
 	WRITE_ONCE(list->qlen, list->qlen + 1);
 }
 
@@ -2099,7 +2101,7 @@ static inline void __skb_queue_after(struct sk_buff_head *list,
 				     struct sk_buff *prev,
 				     struct sk_buff *newsk)
 {
-	__skb_insert(newsk, prev, prev->next, list);
+	__skb_insert(newsk, prev, ((struct sk_buff_list *)prev)->next, list);
 }
 
 void skb_append(struct sk_buff *old, struct sk_buff *newsk,
@@ -2109,7 +2111,7 @@ static inline void __skb_queue_before(struct sk_buff_head *list,
 				      struct sk_buff *next,
 				      struct sk_buff *newsk)
 {
-	__skb_insert(newsk, next->prev, next, list);
+	__skb_insert(newsk, ((struct sk_buff_list *)next)->prev, next, list);
 }
 
 /**