From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 20/60] hns: avoid stack overflow with CONFIG_KASAN
Date: Mon, 13 Feb 2017 05:03:52 -0800 [thread overview]
Message-ID: <20170213130335.884573638@linuxfoundation.org> (raw)
In-Reply-To: <20170213130333.057515084@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit b3f2d07f4649adcf6905953a10d217b5683e4077 upstream.
The use of ACCESS_ONCE() looks like a micro-optimization to force gcc to use
an indexed load for the register address, but it has an absolutely detrimental
effect on builds with gcc-5 and CONFIG_KASAN=y, leading to a very likely
kernel stack overflow aside from very complex object code:
hisilicon/hns/hns_dsaf_gmac.c: In function 'hns_gmac_update_stats':
hisilicon/hns/hns_dsaf_gmac.c:419:1: error: the frame size of 2912 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_ppe.c: In function 'hns_ppe_reset_common':
hisilicon/hns/hns_dsaf_ppe.c:390:1: error: the frame size of 1184 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_ppe.c: In function 'hns_ppe_get_regs':
hisilicon/hns/hns_dsaf_ppe.c:621:1: error: the frame size of 3632 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_rcb.c: In function 'hns_rcb_get_common_regs':
hisilicon/hns/hns_dsaf_rcb.c:970:1: error: the frame size of 2784 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_gmac.c: In function 'hns_gmac_get_regs':
hisilicon/hns/hns_dsaf_gmac.c:641:1: error: the frame size of 5728 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_rcb.c: In function 'hns_rcb_get_ring_regs':
hisilicon/hns/hns_dsaf_rcb.c:1021:1: error: the frame size of 2208 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_main.c: In function 'hns_dsaf_comm_init':
hisilicon/hns/hns_dsaf_main.c:1209:1: error: the frame size of 1904 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_xgmac.c: In function 'hns_xgmac_get_regs':
hisilicon/hns/hns_dsaf_xgmac.c:748:1: error: the frame size of 4704 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_main.c: In function 'hns_dsaf_update_stats':
hisilicon/hns/hns_dsaf_main.c:2420:1: error: the frame size of 1088 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
hisilicon/hns/hns_dsaf_main.c: In function 'hns_dsaf_get_regs':
hisilicon/hns/hns_dsaf_main.c:2753:1: error: the frame size of 10768 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
This does not seem to happen any more with gcc-7, but removing the ACCESS_ONCE
seems safe anyway and it avoids a serious issue for some people. I have verified
that with gcc-5.3.1, the object code we get is better in the new version
both with and without CONFIG_KASAN, as we no longer allocate a 1344 byte
stack frame for hns_dsaf_get_regs() but otherwise have practically identical
object code.
With gcc-7.0.0, removing ACCESS_ONCE has no effect, the object code is already
good either way.
This patch is probably not urgent to get into 4.11 as only KASAN=y builds
with certain compilers are affected, but I still think it makes sense to
backport into older kernels.
Fixes: 511e6bc ("net: add Hisilicon Network Subsystem DSAF support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h
@@ -1007,9 +1007,7 @@
static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value)
{
- u8 __iomem *reg_addr = ACCESS_ONCE(base);
-
- writel(value, reg_addr + reg);
+ writel(value, base + reg);
}
#define dsaf_write_dev(a, reg, value) \
@@ -1017,9 +1015,7 @@ static inline void dsaf_write_reg(void _
static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg)
{
- u8 __iomem *reg_addr = ACCESS_ONCE(base);
-
- return readl(reg_addr + reg);
+ return readl(base + reg);
}
static inline void dsaf_write_syscon(struct regmap *base, u32 reg, u32 value)
next prev parent reply other threads:[~2017-02-13 13:24 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-13 13:03 [PATCH 4.9 00/60] 4.9.10-stable review Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 01/60] cpufreq: intel_pstate: Disable energy efficiency optimization Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 02/60] acpi, nfit: fix acpi_nfit_flush_probe() crash Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 03/60] libnvdimm, namespace: do not delete namespace-id 0 Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 04/60] libnvdimm, pfn: fix memmap reservation size versus 4K alignment Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 05/60] dm rq: cope with DM device destruction while in dm_old_request_fn() Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 07/60] crypto: chcr - Check device is allocated before use Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 08/60] crypto: qat - fix bar discovery for c62x Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 09/60] crypto: qat - zero esram only for DH85x devices Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 10/60] crypto: ccp - Fix DMA operations when IOMMU is enabled Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 11/60] crypto: ccp - Fix double add when creating new DMA command Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 12/60] ARC: [arcompact] brown paper bag bug in unaligned access delay slot fixup Greg Kroah-Hartman
2017-02-13 13:03 ` Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 13/60] Input: uinput - fix crash when mixing old and new init style Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 14/60] selinux: fix off-by-one in setprocattr Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 15/60] Revert "x86/ioapic: Restore IO-APIC irq_chip retrigger callback" Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 16/60] rtlwifi: rtl8192ce: Fix loading of incorrect firmware Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 17/60] cpumask: use nr_cpumask_bits for parsing functions Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 18/60] mm/slub.c: fix random_seq offset destruction Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 19/60] ibmvscsis: Add SGL limit Greg Kroah-Hartman
2017-02-13 13:03 ` Greg Kroah-Hartman [this message]
2017-02-13 13:03 ` [PATCH 4.9 21/60] ARM: 8643/3: arm/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 22/60] drm/i915: fix use-after-free in page_flip_completed() Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 23/60] drm/i915/bxt: Add MST support when do DPLL calculation Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 24/60] drm/atomic: Fix double free in drm_atomic_state_default_clear Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 25/60] target: Dont BUG_ON during NodeACL dynamic -> explicit conversion Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 26/60] target: Use correct SCSI status during EXTENDED_COPY exception Greg Kroah-Hartman
2017-02-13 13:03 ` [PATCH 4.9 27/60] target: Fix early transport_generic_handle_tmr abort scenario Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 28/60] target: Fix multi-session dynamic se_node_acl double free OOPs Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 29/60] target: Fix COMPARE_AND_WRITE ref leak for non GOOD status Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 31/60] ARM: 8642/1: LPAE: catch pending imprecise abort on unmask Greg Kroah-Hartman
2017-02-13 13:04 ` Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 33/60] nl80211: Fix mesh HT operation check Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 34/60] mac80211: Fix adding of mesh vendor IEs Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 35/60] net/mlx5e: Modify TIRs hash only when its needed Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 36/60] Drivers: hv: vmbus: Base host signaling strictly on the ring state Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 37/60] Drivers: hv: vmbus: On write cleanup the logic to interrupt the host Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 38/60] Drivers: hv: vmbus: On the read path " Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 39/60] Drivers: hv: vmbus: finally fix hv_need_to_signal_on_read() Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 40/60] scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 41/60] scsi: aacraid: Fix INTx/MSI-x issue with older controllers Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 42/60] scsi: mpt3sas: disable ASPM for MPI2 controllers Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 43/60] scsi: qla2xxx: Avoid that issuing a LIP triggers a kernel crash Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 44/60] btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 45/60] powerpc/mm/radix: Update ERAT flushes when invalidating TLB Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 46/60] powerpc/powernv: Fix CPU hotplug to handle waking on HVI Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 47/60] xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend() Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 48/60] ALSA: hda - adding a new NV HDMI/DP codec ID in the driver Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 49/60] ALSA: seq: Fix race at creating a queue Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 50/60] ALSA: seq: Dont handle loop timeout at snd_seq_pool_done() Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 51/60] Revert "ALSA: line6: Only determine control port properties if needed" Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 52/60] x86/mm/ptdump: Fix soft lockup in page table walker Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 53/60] x86/CPU/AMD: Bring back Compute Unit ID Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 54/60] x86/CPU/AMD: Fix Zen SMT topology Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 55/60] IB/rxe: Fix resid update Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 56/60] IB/rxe: Fix mem_check_range integer overflow Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 57/60] stacktrace, lockdep: Fix address, newline ugliness Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 58/60] perf diff: Fix -o/--order option behavior (again) Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 59/60] perf diff: Fix segfault on perf diff -o N option Greg Kroah-Hartman
2017-02-13 13:04 ` [PATCH 4.9 60/60] perf/core: Fix crash in perf_event_read() Greg Kroah-Hartman
2017-02-13 17:09 ` [PATCH 4.9 00/60] 4.9.10-stable review Shuah Khan
2017-02-13 17:24 ` Greg Kroah-Hartman
2017-02-13 20:03 ` Guenter Roeck
2017-02-14 22:54 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170213130335.884573638@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=arnd@arndb.de \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.