Message ID | 168870663097.1448934.17365533203887616941.stgit@jupiter (mailing list archive) |
---|---|
State | Superseded |
Headers | show |
Series | [v2] powernv/opal-prd: Silence memcpy() run-time false positive warnings | expand |
Context | Check | Description |
---|---|---|
snowpatch_ozlabs/github-powerpc_selftests | success | Successfully ran 8 jobs. |
snowpatch_ozlabs/github-powerpc_ppctests | success | Successfully ran 8 jobs. |
snowpatch_ozlabs/github-powerpc_sparse | success | Successfully ran 4 jobs. |
snowpatch_ozlabs/github-powerpc_kernel_qemu | success | Successfully ran 23 jobs. |
snowpatch_ozlabs/github-powerpc_clang | success | Successfully ran 6 jobs. |
On Fri, 7 Jul 2023 at 05:11, Mahesh Salgaonkar <mahesh@linux.ibm.com> wrote: > > opal_prd_msg_notifier extracts the opal prd message size from the message > header and uses it for allocating opal_prd_msg_queue_item that includes > the correct message size to be copied. However, while running under > CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: > > [ 6458.234352] memcpy: detected field-spanning write (size 32) of single field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) > [ 6458.234390] WARNING: CPU: 9 PID: 660 at arch/powerpc/platforms/powernv/opal-prd.c:355 opal_prd_msg_notifier+0x174/0x188 [opal_prd] > [...] > [ 6458.234709] NIP [c00800000e0c0e6c] opal_prd_msg_notifier+0x174/0x188 [opal_prd] > [ 6458.234723] LR [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] > [ 6458.234736] Call Trace: > [ 6458.234742] [c0000002acb23c10] [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) > [ 6458.234759] [c0000002acb23ca0] [c00000000019ccc0] notifier_call_chain+0xc0/0x1b0 > [ 6458.234774] [c0000002acb23d00] [c00000000019ceac] atomic_notifier_call_chain+0x2c/0x40 > [ 6458.234788] [c0000002acb23d20] [c0000000000d69b4] opal_message_notify+0xf4/0x2c0 > [...] > > Split the copy to avoid false positive run-time warning. > > Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> > Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> I hit this on a box running the Ubuntu 6.2.0-27-generic kernel. Do we plan on merging this fix? > --- > Change from v1: > - Rework the memcpy to copy message header and rest of the message > separately without adding flex array. > --- > arch/powerpc/platforms/powernv/opal-prd.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/arch/powerpc/platforms/powernv/opal-prd.c b/arch/powerpc/platforms/powernv/opal-prd.c > index 113bdb151f687..a068cbc4d43c0 100644 > --- a/arch/powerpc/platforms/powernv/opal-prd.c > +++ b/arch/powerpc/platforms/powernv/opal-prd.c > @@ -352,7 +352,9 @@ static int opal_prd_msg_notifier(struct notifier_block *nb, > if (!item) > return -ENOMEM; > > - memcpy(&item->msg, msg->params, msg_size); > + item->msg = *hdr; > + hdr++; > + memcpy((char *)&item->msg + sizeof(*hdr), hdr, msg_size - sizeof(*hdr)); > > spin_lock_irqsave(&opal_prd_msg_queue_lock, flags); > list_add_tail(&item->list, &opal_prd_msg_queue); > >
Joel Stanley <joel@jms.id.au> writes: > On Fri, 7 Jul 2023 at 05:11, Mahesh Salgaonkar <mahesh@linux.ibm.com> wrote: >> >> opal_prd_msg_notifier extracts the opal prd message size from the message >> header and uses it for allocating opal_prd_msg_queue_item that includes >> the correct message size to be copied. However, while running under >> CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: >> >> [ 6458.234352] memcpy: detected field-spanning write (size 32) of single field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) >> [ 6458.234390] WARNING: CPU: 9 PID: 660 at arch/powerpc/platforms/powernv/opal-prd.c:355 opal_prd_msg_notifier+0x174/0x188 [opal_prd] >> [...] >> [ 6458.234709] NIP [c00800000e0c0e6c] opal_prd_msg_notifier+0x174/0x188 [opal_prd] >> [ 6458.234723] LR [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] >> [ 6458.234736] Call Trace: >> [ 6458.234742] [c0000002acb23c10] [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) >> [ 6458.234759] [c0000002acb23ca0] [c00000000019ccc0] notifier_call_chain+0xc0/0x1b0 >> [ 6458.234774] [c0000002acb23d00] [c00000000019ceac] atomic_notifier_call_chain+0x2c/0x40 >> [ 6458.234788] [c0000002acb23d20] [c0000000000d69b4] opal_message_notify+0xf4/0x2c0 >> [...] >> >> Split the copy to avoid false positive run-time warning. >> >> Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> >> Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> > > I hit this on a box running the Ubuntu 6.2.0-27-generic kernel. > > Do we plan on merging this fix? I thought it was papering over the issue rather than fixing the root cause. I'll send a new version, as soon as I can work out how to trigger that code path. cheers
On 2023-08-15 06:47, Michael Ellerman wrote: > Joel Stanley <joel@jms.id.au> writes: >> On Fri, 7 Jul 2023 at 05:11, Mahesh Salgaonkar <mahesh@linux.ibm.com> >> wrote: >>> >>> opal_prd_msg_notifier extracts the opal prd message size from the message >>> header and uses it for allocating opal_prd_msg_queue_item that includes >>> the correct message size to be copied. However, while running under >>> CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: >>> >>> [ 6458.234352] memcpy: detected field-spanning write (size 32) of single >>> field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size >>> 4) >>> [ 6458.234390] WARNING: CPU: 9 PID: 660 at >>> arch/powerpc/platforms/powernv/opal-prd.c:355 >>> opal_prd_msg_notifier+0x174/0x188 [opal_prd] >>> [...] >>> [ 6458.234709] NIP [c00800000e0c0e6c] opal_prd_msg_notifier+0x174/0x188 >>> [opal_prd] >>> [ 6458.234723] LR [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 >>> [opal_prd] >>> [ 6458.234736] Call Trace: >>> [ 6458.234742] [c0000002acb23c10] [c00800000e0c0e68] >>> opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) >>> [ 6458.234759] [c0000002acb23ca0] [c00000000019ccc0] >>> notifier_call_chain+0xc0/0x1b0 >>> [ 6458.234774] [c0000002acb23d00] [c00000000019ceac] >>> atomic_notifier_call_chain+0x2c/0x40 >>> [ 6458.234788] [c0000002acb23d20] [c0000000000d69b4] >>> opal_message_notify+0xf4/0x2c0 >>> [...] >>> >>> Split the copy to avoid false positive run-time warning. >>> >>> Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> >>> Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> >> >> I hit this on a box running the Ubuntu 6.2.0-27-generic kernel. >> >> Do we plan on merging this fix? > > I thought it was papering over the issue rather than fixing the root > cause. > > I'll send a new version, as soon as I can work out how to trigger that > code path. > > cheers Hi, I see this was still not accepted. I was able to trigger this simply by starting the opal-prd userspace daemon. Restarting the service does not re-trigger the warning, however. [Wed Nov 15 14:01:06 2023] i2c_dev: i2c /dev entries driver [Wed Nov 15 14:01:07 2023] ------------[ cut here ]------------ [Wed Nov 15 14:01:07 2023] memcpy: detected field-spanning write (size 32) of single field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) [Wed Nov 15 14:01:07 2023] WARNING: CPU: 5 PID: 379 at arch/powerpc/platforms/powernv/opal-prd.c:355 0xc008000000640b1c [Wed Nov 15 14:01:07 2023] Modules linked in: i2c_dev loop vhost_net vhost vhost_iotlb tap kvm_hv kvm bridge rpcsec_gss_krb5 auth_rpcgss tun nfsv4 dns_resolver nfs lockd grace sunrpc fscache netfs cfg80211 rfkill 8021q garp mrp stp llc nft_masq nft_chain_nat nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct binfmt_misc nbd wireguard libcurve25519_generic ip6_udp_tunnel udp_tunnel nft_nat nf_tables nfnetlink nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 at24 ast i2c_algo_bit drm_shmem_helper joydev ftdi_sio crct10dif_vpmsum onboard_usb_hub ofpart drm_kms_helper ipmi_powernv rtc_opal ipmi_devintf powernv_flash ipmi_msghandler mtd opal_prd i2c_opal vmx_crypto nvme crc32c_vpmsum tg3 nvme_core ixgbe nvme_common mdio [Wed Nov 15 14:01:07 2023] CPU: 5 PID: 379 Comm: kopald Not tainted 6.5.9-gentoo-dist #1 [Wed Nov 15 14:01:07 2023] Hardware name: T2P9S01 REV 1.01 POWER9 0x4e1203 opal:skiboot-9858186 PowerNV [Wed Nov 15 14:01:07 2023] NIP: c008000000640b1c LR: c008000000640b18 CTR: 0000000000000000 [Wed Nov 15 14:01:07 2023] REGS: c00000000e2339b0 TRAP: 0700 Not tainted (6.5.9-gentoo-dist) [Wed Nov 15 14:01:07 2023] MSR: 9000000000021033 <SF,HV,ME,IR,DR,RI,LE> CR: 44002222 XER: 00000000 [Wed Nov 15 14:01:07 2023] CFAR: c000000000152b10 IRQMASK: 1 GPR00: c008000000640b18 c00000000e233c50 c008000000668100 0000000000000086 GPR04: 00000000ffff7fff c00000000e233a10 c00000000e233a08 0000001ef74d0000 GPR08: 0000000000000027 c000001ef9626d10 0000000000000001 0000000044002222 GPR12: 20646c6569662065 c000001fff7fb400 c0000000001900e8 c00000000e919540 GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 GPR24: c00000000e959de0 0000000000000006 0000000000000000 c008000000660290 GPR28: c000000007498410 0000000000000020 c00000000e959de8 c000000007498400 [Wed Nov 15 14:01:07 2023] NIP [c008000000640b1c] 0xc008000000640b1c [Wed Nov 15 14:01:07 2023] LR [c008000000640b18] 0xc008000000640b18 [Wed Nov 15 14:01:07 2023] Call Trace: [Wed Nov 15 14:01:07 2023] [c00000000e233c50] [c008000000640b18] 0xc008000000640b18 (unreliable) [Wed Nov 15 14:01:07 2023] [c00000000e233cd0] [c000000000192dd0] notifier_call_chain+0xc0/0x1b0 [Wed Nov 15 14:01:07 2023] [c00000000e233d30] [c000000000192eec] atomic_notifier_call_chain+0x2c/0x40 [Wed Nov 15 14:01:07 2023] [c00000000e233d50] [c0000000000cec44] opal_message_notify+0xf4/0x2a0 [Wed Nov 15 14:01:07 2023] [c00000000e233de0] [c000000000206d58] __handle_irq_event_percpu+0x78/0x240 [Wed Nov 15 14:01:07 2023] [c00000000e233e70] [c000000000207034] handle_irq_event+0x74/0x140 [Wed Nov 15 14:01:07 2023] [c00000000e233ea0] [c00000000020e9bc] handle_level_irq+0xdc/0x270 [Wed Nov 15 14:01:07 2023] [c00000000e233ed0] [c000000000204fb8] generic_handle_domain_irq+0x48/0x70 [Wed Nov 15 14:01:07 2023] [c00000000e233ef0] [c0000000000d6f38] opal_handle_events+0xb8/0x140 [Wed Nov 15 14:01:07 2023] [c00000000e233f50] [c0000000000ce514] kopald+0x84/0x110 [Wed Nov 15 14:01:07 2023] [c00000000e233f90] [c000000000190218] kthread+0x138/0x140 [Wed Nov 15 14:01:07 2023] [c00000000e233fe0] [c00000000000ded8] start_kernel_thread+0x14/0x18 [Wed Nov 15 14:01:07 2023] Code: 2c0a0000 4082ff48 3ca20000 e8a58050 3c620000 e8638058 39400001 38c00004 7fa4eb78 99490000 480004c5 e8410018 <0fe00000> 4bffff18 3860fff4 4bffff8c [Wed Nov 15 14:01:07 2023] ---[ end trace 0000000000000000 ]---
matoro <matoro_mailinglist_kernel@matoro.tk> writes: > On 2023-08-15 06:47, Michael Ellerman wrote: >> Joel Stanley <joel@jms.id.au> writes: >>> On Fri, 7 Jul 2023 at 05:11, Mahesh Salgaonkar <mahesh@linux.ibm.com> >>> wrote: >>>> >>>> opal_prd_msg_notifier extracts the opal prd message size from the message >>>> header and uses it for allocating opal_prd_msg_queue_item that includes >>>> the correct message size to be copied. However, while running under >>>> CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: >>>> >>>> [ 6458.234352] memcpy: detected field-spanning write (size 32) of single >>>> field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size >>>> 4) >>>> [ 6458.234390] WARNING: CPU: 9 PID: 660 at >>>> arch/powerpc/platforms/powernv/opal-prd.c:355 >>>> opal_prd_msg_notifier+0x174/0x188 [opal_prd] >>>> [...] >>>> [ 6458.234709] NIP [c00800000e0c0e6c] opal_prd_msg_notifier+0x174/0x188 >>>> [opal_prd] >>>> [ 6458.234723] LR [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 >>>> [opal_prd] >>>> [ 6458.234736] Call Trace: >>>> [ 6458.234742] [c0000002acb23c10] [c00800000e0c0e68] >>>> opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) >>>> [ 6458.234759] [c0000002acb23ca0] [c00000000019ccc0] >>>> notifier_call_chain+0xc0/0x1b0 >>>> [ 6458.234774] [c0000002acb23d00] [c00000000019ceac] >>>> atomic_notifier_call_chain+0x2c/0x40 >>>> [ 6458.234788] [c0000002acb23d20] [c0000000000d69b4] >>>> opal_message_notify+0xf4/0x2c0 >>>> [...] >>>> >>>> Split the copy to avoid false positive run-time warning. >>>> >>>> Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> >>>> Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> >>> >>> I hit this on a box running the Ubuntu 6.2.0-27-generic kernel. >>> >>> Do we plan on merging this fix? >> >> I thought it was papering over the issue rather than fixing the root >> cause. >> >> I'll send a new version, as soon as I can work out how to trigger that >> code path. >> >> cheers > > Hi, I see this was still not accepted. I was able to trigger this simply by > starting the opal-prd userspace daemon. > Restarting the service does not re-trigger the warning, however. It should be fixed by: https://git.kernel.org/torvalds/c/feea65a338e52297b68ceb688eaf0ffc50310a83 Which went into v6.6. > [Wed Nov 15 14:01:06 2023] i2c_dev: i2c /dev entries driver > [Wed Nov 15 14:01:07 2023] ------------[ cut here ]------------ > [Wed Nov 15 14:01:07 2023] memcpy: detected field-spanning write (size 32) of > single field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 > (size 4) > [Wed Nov 15 14:01:07 2023] WARNING: CPU: 5 PID: 379 at > arch/powerpc/platforms/powernv/opal-prd.c:355 0xc008000000640b1c > [Wed Nov 15 14:01:07 2023] Modules linked in: i2c_dev loop vhost_net vhost > vhost_iotlb tap kvm_hv kvm bridge rpcsec_gss_krb5 auth_rpcgss tun nfsv4 > dns_resolver nfs lockd grace sunrpc fscache netfs cfg80211 rfkill 8021q garp > mrp stp llc nft_masq nft_chain_nat nft_reject_inet nf_reject_ipv4 > nf_reject_ipv6 nft_reject nft_ct binfmt_misc nbd wireguard > libcurve25519_generic ip6_udp_tunnel udp_tunnel nft_nat nf_tables nfnetlink > nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 at24 ast i2c_algo_bit > drm_shmem_helper joydev ftdi_sio crct10dif_vpmsum onboard_usb_hub ofpart > drm_kms_helper ipmi_powernv rtc_opal ipmi_devintf powernv_flash > ipmi_msghandler mtd opal_prd i2c_opal vmx_crypto nvme crc32c_vpmsum tg3 > nvme_core ixgbe nvme_common mdio > [Wed Nov 15 14:01:07 2023] CPU: 5 PID: 379 Comm: kopald Not tainted > 6.5.9-gentoo-dist #1 I'll request a back port of the fix to 6.5 stable. cheers
diff --git a/arch/powerpc/platforms/powernv/opal-prd.c b/arch/powerpc/platforms/powernv/opal-prd.c index 113bdb151f687..a068cbc4d43c0 100644 --- a/arch/powerpc/platforms/powernv/opal-prd.c +++ b/arch/powerpc/platforms/powernv/opal-prd.c @@ -352,7 +352,9 @@ static int opal_prd_msg_notifier(struct notifier_block *nb, if (!item) return -ENOMEM; - memcpy(&item->msg, msg->params, msg_size); + item->msg = *hdr; + hdr++; + memcpy((char *)&item->msg + sizeof(*hdr), hdr, msg_size - sizeof(*hdr)); spin_lock_irqsave(&opal_prd_msg_queue_lock, flags); list_add_tail(&item->list, &opal_prd_msg_queue);
opal_prd_msg_notifier extracts the opal prd message size from the message header and uses it for allocating opal_prd_msg_queue_item that includes the correct message size to be copied. However, while running under CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: [ 6458.234352] memcpy: detected field-spanning write (size 32) of single field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) [ 6458.234390] WARNING: CPU: 9 PID: 660 at arch/powerpc/platforms/powernv/opal-prd.c:355 opal_prd_msg_notifier+0x174/0x188 [opal_prd] [...] [ 6458.234709] NIP [c00800000e0c0e6c] opal_prd_msg_notifier+0x174/0x188 [opal_prd] [ 6458.234723] LR [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] [ 6458.234736] Call Trace: [ 6458.234742] [c0000002acb23c10] [c00800000e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) [ 6458.234759] [c0000002acb23ca0] [c00000000019ccc0] notifier_call_chain+0xc0/0x1b0 [ 6458.234774] [c0000002acb23d00] [c00000000019ceac] atomic_notifier_call_chain+0x2c/0x40 [ 6458.234788] [c0000002acb23d20] [c0000000000d69b4] opal_message_notify+0xf4/0x2c0 [...] Split the copy to avoid false positive run-time warning. Reported-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> Signed-off-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> --- Change from v1: - Rework the memcpy to copy message header and rest of the message separately without adding flex array. --- arch/powerpc/platforms/powernv/opal-prd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)