* [intel-linux-intel-lts:4.19/android 8/8] drivers/soc/qcom/smem.c:491:19: error: 'struct qcom_smem' has no member named 'global_partition'
@ 2020-11-04 5:01 kernel test robot
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2020-11-04 5:01 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 21113 bytes --]
tree: https://github.com/intel/linux-intel-lts.git 4.19/android
head: 412ae5100f1356b2a509a62ab14093ff6f26acfd
commit: 412ae5100f1356b2a509a62ab14093ff6f26acfd [8/8] soc: qcom: smem: validate fields of shared structures Structures in shared memory that can be modified by remote processors may have untrusted values, they should be validated before use.
config: arm64-allyesconfig (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel/linux-intel-lts/commit/412ae5100f1356b2a509a62ab14093ff6f26acfd
git remote add intel-linux-intel-lts https://github.com/intel/linux-intel-lts.git
git fetch --no-tags intel-linux-intel-lts 4.19/android
git checkout 412ae5100f1356b2a509a62ab14093ff6f26acfd
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=arm64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All error/warnings (new ones prefixed by >>):
drivers/soc/qcom/smem.c: In function 'qcom_smem_alloc':
>> drivers/soc/qcom/smem.c:491:19: error: 'struct qcom_smem' has no member named 'global_partition'
491 | } else if (__smem->global_partition) {
| ^~
>> drivers/soc/qcom/smem.c:492:11: error: incompatible types when assigning to type 'struct smem_ptable_entry *' from type 'struct smem_ptable_entry'
492 | entry = __smem->global_ptable_entries[host];
| ^~~~~~
drivers/soc/qcom/smem.c:465:32: warning: unused variable 'phdr' [-Wunused-variable]
465 | struct smem_partition_header *phdr;
| ^~~~
drivers/soc/qcom/smem.c: In function 'qcom_smem_get_private':
drivers/soc/qcom/smem.c:549:36: error: expected ';' before 'struct'
549 | struct smem_partition_header *phdr
| ^
| ;
550 | struct smem_private_entry *e, *end;
| ~~~~~~
drivers/soc/qcom/smem.c:556:2: error: 'phdr' undeclared (first use in this function)
556 | phdr = ptable_entry_to_phdr(entry);
| ^~~~
drivers/soc/qcom/smem.c:556:2: note: each undeclared identifier is reported only once for each function it appears in
>> drivers/soc/qcom/smem.c:581:15: error: implicit declaration of function 'entry_to_item'; did you mean 'cached_entry_to_item'? [-Werror=implicit-function-declaration]
581 | item_ptr = entry_to_item(e);
| ^~~~~~~~~~~~~
| cached_entry_to_item
>> drivers/soc/qcom/smem.c:581:13: warning: assignment to 'void *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
581 | item_ptr = entry_to_item(e);
| ^
drivers/soc/qcom/smem.c: In function 'qcom_smem_get':
drivers/soc/qcom/smem.c:655:19: error: 'struct qcom_smem' has no member named 'global_partition'
655 | } else if (__smem->global_partition) {
| ^~
drivers/soc/qcom/smem.c:656:11: error: incompatible types when assigning to type 'struct smem_ptable_entry *' from type 'struct smem_ptable_entry'
656 | entry = __smem->global_ptable_entries[host];
| ^~~~~~
drivers/soc/qcom/smem.c:632:32: warning: unused variable 'phdr' [-Wunused-variable]
632 | struct smem_partition_header *phdr;
| ^~~~
drivers/soc/qcom/smem.c: In function 'qcom_smem_get_free_space':
>> drivers/soc/qcom/smem.c:696:8: error: assignment to 'struct smem_partition_header *' from incompatible pointer type 'struct smem_ptable_entry *' [-Werror=incompatible-pointer-types]
696 | phdr = __smem->global_ptable_entries;
| ^
drivers/soc/qcom/smem.c: In function 'qcom_smem_set_global_partition':
drivers/soc/qcom/smem.c:791:10: error: 'struct qcom_smem' has no member named 'global_partition'
791 | if (smem->global_partition) {
| ^~
drivers/soc/qcom/smem.c:847:6: error: 'struct qcom_smem' has no member named 'global_partition'
847 | smem->global_partition = header;
| ^~
At top level:
drivers/soc/qcom/smem.c:346:14: warning: 'uncached_entry_to_item' defined but not used [-Wunused-function]
346 | static void *uncached_entry_to_item(struct smem_private_entry *e)
| ^~~~~~~~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +491 drivers/soc/qcom/smem.c
4b638df4c9d556a Bjorn Andersson 2015-06-26 453
4b638df4c9d556a Bjorn Andersson 2015-06-26 454 /**
4b638df4c9d556a Bjorn Andersson 2015-06-26 455 * qcom_smem_alloc() - allocate space for a smem item
4b638df4c9d556a Bjorn Andersson 2015-06-26 456 * @host: remote processor id, or -1
4b638df4c9d556a Bjorn Andersson 2015-06-26 457 * @item: smem item handle
4b638df4c9d556a Bjorn Andersson 2015-06-26 458 * @size: number of bytes to be allocated
4b638df4c9d556a Bjorn Andersson 2015-06-26 459 *
4b638df4c9d556a Bjorn Andersson 2015-06-26 460 * Allocate space for a given smem item of size @size, given that the item is
4b638df4c9d556a Bjorn Andersson 2015-06-26 461 * not yet allocated.
4b638df4c9d556a Bjorn Andersson 2015-06-26 462 */
4b638df4c9d556a Bjorn Andersson 2015-06-26 463 int qcom_smem_alloc(unsigned host, unsigned item, size_t size)
4b638df4c9d556a Bjorn Andersson 2015-06-26 464 {
d52e404874369f1 Chris Lew 2017-10-11 465 struct smem_partition_header *phdr;
412ae5100f1356b nanli2x 2020-09-22 466 struct smem_ptable_entry *entry;
4b638df4c9d556a Bjorn Andersson 2015-06-26 467 unsigned long flags;
4b638df4c9d556a Bjorn Andersson 2015-06-26 468 int ret;
4b638df4c9d556a Bjorn Andersson 2015-06-26 469
4b638df4c9d556a Bjorn Andersson 2015-06-26 470 if (!__smem)
4b638df4c9d556a Bjorn Andersson 2015-06-26 471 return -EPROBE_DEFER;
4b638df4c9d556a Bjorn Andersson 2015-06-26 472
4b638df4c9d556a Bjorn Andersson 2015-06-26 473 if (item < SMEM_ITEM_LAST_FIXED) {
4b638df4c9d556a Bjorn Andersson 2015-06-26 474 dev_err(__smem->dev,
4b638df4c9d556a Bjorn Andersson 2015-06-26 475 "Rejecting allocation of static entry %d\n", item);
4b638df4c9d556a Bjorn Andersson 2015-06-26 476 return -EINVAL;
4b638df4c9d556a Bjorn Andersson 2015-06-26 477 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 478
5b3940676107dd6 Chris Lew 2017-10-11 479 if (WARN_ON(item >= __smem->item_count))
5b3940676107dd6 Chris Lew 2017-10-11 480 return -EINVAL;
5b3940676107dd6 Chris Lew 2017-10-11 481
4b638df4c9d556a Bjorn Andersson 2015-06-26 482 ret = hwspin_lock_timeout_irqsave(__smem->hwlock,
4b638df4c9d556a Bjorn Andersson 2015-06-26 483 HWSPINLOCK_TIMEOUT,
4b638df4c9d556a Bjorn Andersson 2015-06-26 484 &flags);
4b638df4c9d556a Bjorn Andersson 2015-06-26 485 if (ret)
4b638df4c9d556a Bjorn Andersson 2015-06-26 486 return ret;
4b638df4c9d556a Bjorn Andersson 2015-06-26 487
412ae5100f1356b nanli2x 2020-09-22 488 if (host < SMEM_HOST_COUNT && __smem->ptable_entries[host]) {
412ae5100f1356b nanli2x 2020-09-22 489 entry = __smem->ptable_entries[host];
412ae5100f1356b nanli2x 2020-09-22 490 ret = qcom_smem_alloc_private(__smem, entry, item, size);
d52e404874369f1 Chris Lew 2017-10-11 @491 } else if (__smem->global_partition) {
412ae5100f1356b nanli2x 2020-09-22 @492 entry = __smem->global_ptable_entries[host];
412ae5100f1356b nanli2x 2020-09-22 493 ret = qcom_smem_alloc_private(__smem, entry, item, size);
d52e404874369f1 Chris Lew 2017-10-11 494 } else {
4b638df4c9d556a Bjorn Andersson 2015-06-26 495 ret = qcom_smem_alloc_global(__smem, item, size);
d52e404874369f1 Chris Lew 2017-10-11 496 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 497
4b638df4c9d556a Bjorn Andersson 2015-06-26 498 hwspin_unlock_irqrestore(__smem->hwlock, &flags);
4b638df4c9d556a Bjorn Andersson 2015-06-26 499
4b638df4c9d556a Bjorn Andersson 2015-06-26 500 return ret;
4b638df4c9d556a Bjorn Andersson 2015-06-26 501 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 502 EXPORT_SYMBOL(qcom_smem_alloc);
4b638df4c9d556a Bjorn Andersson 2015-06-26 503
1a03964dec3cecb Stephen Boyd 2015-09-02 504 static void *qcom_smem_get_global(struct qcom_smem *smem,
4b638df4c9d556a Bjorn Andersson 2015-06-26 505 unsigned item,
4b638df4c9d556a Bjorn Andersson 2015-06-26 506 size_t *size)
4b638df4c9d556a Bjorn Andersson 2015-06-26 507 {
412ae5100f1356b nanli2x 2020-09-22 508 struct smem_global_entry *entry;
4b638df4c9d556a Bjorn Andersson 2015-06-26 509 struct smem_header *header;
4b638df4c9d556a Bjorn Andersson 2015-06-26 510 struct smem_region *area;
412ae5100f1356b nanli2x 2020-09-22 511 u64 entry_offset;
412ae5100f1356b nanli2x 2020-09-22 512 u32 e_size;
4b638df4c9d556a Bjorn Andersson 2015-06-26 513 u32 aux_base;
4b638df4c9d556a Bjorn Andersson 2015-06-26 514 unsigned i;
4b638df4c9d556a Bjorn Andersson 2015-06-26 515
4b638df4c9d556a Bjorn Andersson 2015-06-26 516 header = smem->regions[0].virt_base;
4b638df4c9d556a Bjorn Andersson 2015-06-26 517 entry = &header->toc[item];
4b638df4c9d556a Bjorn Andersson 2015-06-26 518 if (!entry->allocated)
1a03964dec3cecb Stephen Boyd 2015-09-02 519 return ERR_PTR(-ENXIO);
4b638df4c9d556a Bjorn Andersson 2015-06-26 520
9806884d8cd552e Stephen Boyd 2015-09-02 521 aux_base = le32_to_cpu(entry->aux_base) & AUX_BASE_MASK;
4b638df4c9d556a Bjorn Andersson 2015-06-26 522
4b638df4c9d556a Bjorn Andersson 2015-06-26 523 for (i = 0; i < smem->num_regions; i++) {
4b638df4c9d556a Bjorn Andersson 2015-06-26 524 area = &smem->regions[i];
4b638df4c9d556a Bjorn Andersson 2015-06-26 525
4b638df4c9d556a Bjorn Andersson 2015-06-26 526 if (area->aux_base == aux_base || !aux_base) {
412ae5100f1356b nanli2x 2020-09-22 527 e_size = le32_to_cpu(entry->size);
412ae5100f1356b nanli2x 2020-09-22 528 entry_offset = le32_to_cpu(entry->offset);
412ae5100f1356b nanli2x 2020-09-22 529
412ae5100f1356b nanli2x 2020-09-22 530 if (WARN_ON(e_size + entry_offset > area->size))
412ae5100f1356b nanli2x 2020-09-22 531 return ERR_PTR(-EINVAL);
412ae5100f1356b nanli2x 2020-09-22 532
4b638df4c9d556a Bjorn Andersson 2015-06-26 533 if (size != NULL)
412ae5100f1356b nanli2x 2020-09-22 534 *size = e_size;
412ae5100f1356b nanli2x 2020-09-22 535
412ae5100f1356b nanli2x 2020-09-22 536 return area->virt_base + entry_offset;
1a03964dec3cecb Stephen Boyd 2015-09-02 537 }
1a03964dec3cecb Stephen Boyd 2015-09-02 538 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 539
1a03964dec3cecb Stephen Boyd 2015-09-02 540 return ERR_PTR(-ENOENT);
4b638df4c9d556a Bjorn Andersson 2015-06-26 541 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 542
1a03964dec3cecb Stephen Boyd 2015-09-02 543 static void *qcom_smem_get_private(struct qcom_smem *smem,
412ae5100f1356b nanli2x 2020-09-22 544 struct smem_ptable_entry *entry,
d52e404874369f1 Chris Lew 2017-10-11 545 size_t cacheline,
4b638df4c9d556a Bjorn Andersson 2015-06-26 546 unsigned item,
4b638df4c9d556a Bjorn Andersson 2015-06-26 547 size_t *size)
4b638df4c9d556a Bjorn Andersson 2015-06-26 548 {
412ae5100f1356b nanli2x 2020-09-22 549 struct smem_partition_header *phdr
9806884d8cd552e Stephen Boyd 2015-09-02 550 struct smem_private_entry *e, *end;
412ae5100f1356b nanli2x 2020-09-22 551 void *item_ptr, *p_end;
412ae5100f1356b nanli2x 2020-09-22 552 u32 partition_size;
412ae5100f1356b nanli2x 2020-09-22 553 u32 padding_data;
412ae5100f1356b nanli2x 2020-09-22 554 u32 e_size;
412ae5100f1356b nanli2x 2020-09-22 555
412ae5100f1356b nanli2x 2020-09-22 @556 phdr = ptable_entry_to_phdr(entry);
412ae5100f1356b nanli2x 2020-09-22 557 partition_size = le32_to_cpu(entry->size);
412ae5100f1356b nanli2x 2020-09-22 558 p_end = (void *)phdr + partition_size;
c7c1dc35871378e Bjorn Andersson 2017-10-04 559
01f141544413aa5 Bjorn Andersson 2017-10-04 560 e = phdr_to_first_uncached_entry(phdr);
01f141544413aa5 Bjorn Andersson 2017-10-04 561 end = phdr_to_last_uncached_entry(phdr);
412ae5100f1356b nanli2x 2020-09-22 562 if (WARN_ON((void *)end > p_end))
412ae5100f1356b nanli2x 2020-09-22 563 return ERR_PTR(-EINVAL);
4b638df4c9d556a Bjorn Andersson 2015-06-26 564
9806884d8cd552e Stephen Boyd 2015-09-02 565 while (e < end) {
c7c1dc35871378e Bjorn Andersson 2017-10-04 566 if (e->canary != SMEM_PRIVATE_CANARY)
c7c1dc35871378e Bjorn Andersson 2017-10-04 567 goto invalid_canary;
4b638df4c9d556a Bjorn Andersson 2015-06-26 568
9806884d8cd552e Stephen Boyd 2015-09-02 569 if (le16_to_cpu(e->item) == item) {
412ae5100f1356b nanli2x 2020-09-22 570 if (size != NULL) {
412ae5100f1356b nanli2x 2020-09-22 571 e_size = le32_to_cpu(e->size);
412ae5100f1356b nanli2x 2020-09-22 572 padding_data = le16_to_cpu(e->padding_data);
4b638df4c9d556a Bjorn Andersson 2015-06-26 573
412ae5100f1356b nanli2x 2020-09-22 574 if (e_size < partition_size
412ae5100f1356b nanli2x 2020-09-22 575 && padding_data < e_size)
412ae5100f1356b nanli2x 2020-09-22 576 *size = e_size - padding_data;
412ae5100f1356b nanli2x 2020-09-22 577 else
412ae5100f1356b nanli2x 2020-09-22 578 return ERR_PTR(-EINVAL);
4b638df4c9d556a Bjorn Andersson 2015-06-26 579 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 580
412ae5100f1356b nanli2x 2020-09-22 @581 item_ptr = entry_to_item(e);
412ae5100f1356b nanli2x 2020-09-22 582 if (WARN_ON(item_ptr > p_end))
412ae5100f1356b nanli2x 2020-09-22 583 return ERR_PTR(-EINVAL);
412ae5100f1356b nanli2x 2020-09-22 584
412ae5100f1356b nanli2x 2020-09-22 585 return item_ptr;
412ae5100f1356b nanli2x 2020-09-22 586 }
01f141544413aa5 Bjorn Andersson 2017-10-04 587 e = uncached_entry_next(e);
4b638df4c9d556a Bjorn Andersson 2015-06-26 588 }
412ae5100f1356b nanli2x 2020-09-22 589 if (WARN_ON((void *)e > p_end))
412ae5100f1356b nanli2x 2020-09-22 590 return ERR_PTR(-EINVAL);
4b638df4c9d556a Bjorn Andersson 2015-06-26 591
c7c1dc35871378e Bjorn Andersson 2017-10-04 592 /* Item was not found in the uncached list, search the cached list */
c7c1dc35871378e Bjorn Andersson 2017-10-04 593
c7c1dc35871378e Bjorn Andersson 2017-10-04 594 e = phdr_to_first_cached_entry(phdr, cacheline);
c7c1dc35871378e Bjorn Andersson 2017-10-04 595 end = phdr_to_last_cached_entry(phdr);
c7c1dc35871378e Bjorn Andersson 2017-10-04 596
c7c1dc35871378e Bjorn Andersson 2017-10-04 597 while (e > end) {
c7c1dc35871378e Bjorn Andersson 2017-10-04 598 if (e->canary != SMEM_PRIVATE_CANARY)
c7c1dc35871378e Bjorn Andersson 2017-10-04 599 goto invalid_canary;
c7c1dc35871378e Bjorn Andersson 2017-10-04 600
c7c1dc35871378e Bjorn Andersson 2017-10-04 601 if (le16_to_cpu(e->item) == item) {
c7c1dc35871378e Bjorn Andersson 2017-10-04 602 if (size != NULL)
c7c1dc35871378e Bjorn Andersson 2017-10-04 603 *size = le32_to_cpu(e->size) -
c7c1dc35871378e Bjorn Andersson 2017-10-04 604 le16_to_cpu(e->padding_data);
c7c1dc35871378e Bjorn Andersson 2017-10-04 605
c7c1dc35871378e Bjorn Andersson 2017-10-04 606 return cached_entry_to_item(e);
c7c1dc35871378e Bjorn Andersson 2017-10-04 607 }
c7c1dc35871378e Bjorn Andersson 2017-10-04 608
c7c1dc35871378e Bjorn Andersson 2017-10-04 609 e = cached_entry_next(e, cacheline);
c7c1dc35871378e Bjorn Andersson 2017-10-04 610 }
c7c1dc35871378e Bjorn Andersson 2017-10-04 611
1a03964dec3cecb Stephen Boyd 2015-09-02 612 return ERR_PTR(-ENOENT);
c7c1dc35871378e Bjorn Andersson 2017-10-04 613
c7c1dc35871378e Bjorn Andersson 2017-10-04 614 invalid_canary:
04a512fea333369 Alex Elder 2018-04-10 615 dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
04a512fea333369 Alex Elder 2018-04-10 616 le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
c7c1dc35871378e Bjorn Andersson 2017-10-04 617
c7c1dc35871378e Bjorn Andersson 2017-10-04 618 return ERR_PTR(-EINVAL);
4b638df4c9d556a Bjorn Andersson 2015-06-26 619 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 620
4b638df4c9d556a Bjorn Andersson 2015-06-26 621 /**
4b638df4c9d556a Bjorn Andersson 2015-06-26 622 * qcom_smem_get() - resolve ptr of size of a smem item
4b638df4c9d556a Bjorn Andersson 2015-06-26 623 * @host: the remote processor, or -1
4b638df4c9d556a Bjorn Andersson 2015-06-26 624 * @item: smem item handle
4b638df4c9d556a Bjorn Andersson 2015-06-26 625 * @size: pointer to be filled out with size of the item
4b638df4c9d556a Bjorn Andersson 2015-06-26 626 *
1a03964dec3cecb Stephen Boyd 2015-09-02 627 * Looks up smem item and returns pointer to it. Size of smem
1a03964dec3cecb Stephen Boyd 2015-09-02 628 * item is returned in @size.
4b638df4c9d556a Bjorn Andersson 2015-06-26 629 */
1a03964dec3cecb Stephen Boyd 2015-09-02 630 void *qcom_smem_get(unsigned host, unsigned item, size_t *size)
4b638df4c9d556a Bjorn Andersson 2015-06-26 631 {
d52e404874369f1 Chris Lew 2017-10-11 632 struct smem_partition_header *phdr;
412ae5100f1356b nanli2x 2020-09-22 633 struct smem_ptable_entry *entry;
4b638df4c9d556a Bjorn Andersson 2015-06-26 634 unsigned long flags;
d52e404874369f1 Chris Lew 2017-10-11 635 size_t cacheln;
4b638df4c9d556a Bjorn Andersson 2015-06-26 636 int ret;
1a03964dec3cecb Stephen Boyd 2015-09-02 637 void *ptr = ERR_PTR(-EPROBE_DEFER);
4b638df4c9d556a Bjorn Andersson 2015-06-26 638
4b638df4c9d556a Bjorn Andersson 2015-06-26 639 if (!__smem)
1a03964dec3cecb Stephen Boyd 2015-09-02 640 return ptr;
4b638df4c9d556a Bjorn Andersson 2015-06-26 641
5b3940676107dd6 Chris Lew 2017-10-11 642 if (WARN_ON(item >= __smem->item_count))
5b3940676107dd6 Chris Lew 2017-10-11 643 return ERR_PTR(-EINVAL);
5b3940676107dd6 Chris Lew 2017-10-11 644
4b638df4c9d556a Bjorn Andersson 2015-06-26 645 ret = hwspin_lock_timeout_irqsave(__smem->hwlock,
4b638df4c9d556a Bjorn Andersson 2015-06-26 646 HWSPINLOCK_TIMEOUT,
4b638df4c9d556a Bjorn Andersson 2015-06-26 647 &flags);
4b638df4c9d556a Bjorn Andersson 2015-06-26 648 if (ret)
1a03964dec3cecb Stephen Boyd 2015-09-02 649 return ERR_PTR(ret);
4b638df4c9d556a Bjorn Andersson 2015-06-26 650
412ae5100f1356b nanli2x 2020-09-22 651 if (host < SMEM_HOST_COUNT && __smem->ptable_entries[host]) {
412ae5100f1356b nanli2x 2020-09-22 652 entry = __smem->ptable_entries[host];
d52e404874369f1 Chris Lew 2017-10-11 653 cacheln = __smem->cacheline[host];
412ae5100f1356b nanli2x 2020-09-22 654 ptr = qcom_smem_get_private(__smem, entry, cacheln, item, size);
d52e404874369f1 Chris Lew 2017-10-11 655 } else if (__smem->global_partition) {
412ae5100f1356b nanli2x 2020-09-22 @656 entry = __smem->global_ptable_entries[host];
d52e404874369f1 Chris Lew 2017-10-11 657 cacheln = __smem->global_cacheline;
412ae5100f1356b nanli2x 2020-09-22 658 ptr = qcom_smem_get_private(__smem, entry, cacheln, item, size);
d52e404874369f1 Chris Lew 2017-10-11 659 } else {
1a03964dec3cecb Stephen Boyd 2015-09-02 660 ptr = qcom_smem_get_global(__smem, item, size);
d52e404874369f1 Chris Lew 2017-10-11 661 }
4b638df4c9d556a Bjorn Andersson 2015-06-26 662
4b638df4c9d556a Bjorn Andersson 2015-06-26 663 hwspin_unlock_irqrestore(__smem->hwlock, &flags);
1a03964dec3cecb Stephen Boyd 2015-09-02 664
1a03964dec3cecb Stephen Boyd 2015-09-02 665 return ptr;
4b638df4c9d556a Bjorn Andersson 2015-06-26 666
:::::: The code at line 491 was first introduced by commit
:::::: d52e404874369f10d20519f4095478d9cb4d6aad soc: qcom: smem: Support global partition
:::::: TO: Chris Lew <clew@codeaurora.org>
:::::: CC: Andy Gross <andy.gross@linaro.org>
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 61521 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* [intel-linux-intel-lts:4.19/android 8/8] drivers/soc/qcom/smem.c:491:19: error: 'struct qcom_smem' has no member named 'global_partition'
@ 2021-03-07 12:50 kernel test robot
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2021-03-07 12:50 UTC (permalink / raw)
To: kbuild-all
[-- Attachment #1: Type: text/plain, Size: 17383 bytes --]
tree: https://github.com/intel/linux-intel-lts.git 4.19/android
head: 412ae5100f1356b2a509a62ab14093ff6f26acfd
commit: 412ae5100f1356b2a509a62ab14093ff6f26acfd [8/8] soc: qcom: smem: validate fields of shared structures Structures in shared memory that can be modified by remote processors may have untrusted values, they should be validated before use.
config: arm64-defconfig (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel/linux-intel-lts/commit/412ae5100f1356b2a509a62ab14093ff6f26acfd
git remote add intel-linux-intel-lts https://github.com/intel/linux-intel-lts.git
git fetch --no-tags intel-linux-intel-lts 4.19/android
git checkout 412ae5100f1356b2a509a62ab14093ff6f26acfd
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-9.3.0 make.cross ARCH=arm64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
All error/warnings (new ones prefixed by >>):
drivers/soc/qcom/smem.c: In function 'qcom_smem_alloc':
>> drivers/soc/qcom/smem.c:491:19: error: 'struct qcom_smem' has no member named 'global_partition'
491 | } else if (__smem->global_partition) {
| ^~
>> drivers/soc/qcom/smem.c:492:11: error: incompatible types when assigning to type 'struct smem_ptable_entry *' from type 'struct smem_ptable_entry'
492 | entry = __smem->global_ptable_entries[host];
| ^~~~~~
drivers/soc/qcom/smem.c:465:32: warning: unused variable 'phdr' [-Wunused-variable]
465 | struct smem_partition_header *phdr;
| ^~~~
drivers/soc/qcom/smem.c: In function 'qcom_smem_get_private':
>> drivers/soc/qcom/smem.c:549:36: error: expected ';' before 'struct'
549 | struct smem_partition_header *phdr
| ^
| ;
550 | struct smem_private_entry *e, *end;
| ~~~~~~
>> drivers/soc/qcom/smem.c:556:2: error: 'phdr' undeclared (first use in this function)
556 | phdr = ptable_entry_to_phdr(entry);
| ^~~~
drivers/soc/qcom/smem.c:556:2: note: each undeclared identifier is reported only once for each function it appears in
>> drivers/soc/qcom/smem.c:581:15: error: implicit declaration of function 'entry_to_item'; did you mean 'cached_entry_to_item'? [-Werror=implicit-function-declaration]
581 | item_ptr = entry_to_item(e);
| ^~~~~~~~~~~~~
| cached_entry_to_item
>> drivers/soc/qcom/smem.c:581:13: warning: assignment to 'void *' from 'int' makes pointer from integer without a cast [-Wint-conversion]
581 | item_ptr = entry_to_item(e);
| ^
drivers/soc/qcom/smem.c: In function 'qcom_smem_get':
drivers/soc/qcom/smem.c:655:19: error: 'struct qcom_smem' has no member named 'global_partition'
655 | } else if (__smem->global_partition) {
| ^~
drivers/soc/qcom/smem.c:656:11: error: incompatible types when assigning to type 'struct smem_ptable_entry *' from type 'struct smem_ptable_entry'
656 | entry = __smem->global_ptable_entries[host];
| ^~~~~~
drivers/soc/qcom/smem.c:632:32: warning: unused variable 'phdr' [-Wunused-variable]
632 | struct smem_partition_header *phdr;
| ^~~~
drivers/soc/qcom/smem.c: In function 'qcom_smem_get_free_space':
>> drivers/soc/qcom/smem.c:696:8: error: assignment to 'struct smem_partition_header *' from incompatible pointer type 'struct smem_ptable_entry *' [-Werror=incompatible-pointer-types]
696 | phdr = __smem->global_ptable_entries;
| ^
drivers/soc/qcom/smem.c: In function 'qcom_smem_set_global_partition':
drivers/soc/qcom/smem.c:791:10: error: 'struct qcom_smem' has no member named 'global_partition'
791 | if (smem->global_partition) {
| ^~
drivers/soc/qcom/smem.c:847:6: error: 'struct qcom_smem' has no member named 'global_partition'
847 | smem->global_partition = header;
| ^~
At top level:
drivers/soc/qcom/smem.c:346:14: warning: 'uncached_entry_to_item' defined but not used [-Wunused-function]
346 | static void *uncached_entry_to_item(struct smem_private_entry *e)
| ^~~~~~~~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
vim +491 drivers/soc/qcom/smem.c
4b638df4c9d556 Bjorn Andersson 2015-06-26 453
4b638df4c9d556 Bjorn Andersson 2015-06-26 454 /**
4b638df4c9d556 Bjorn Andersson 2015-06-26 455 * qcom_smem_alloc() - allocate space for a smem item
4b638df4c9d556 Bjorn Andersson 2015-06-26 456 * @host: remote processor id, or -1
4b638df4c9d556 Bjorn Andersson 2015-06-26 457 * @item: smem item handle
4b638df4c9d556 Bjorn Andersson 2015-06-26 458 * @size: number of bytes to be allocated
4b638df4c9d556 Bjorn Andersson 2015-06-26 459 *
4b638df4c9d556 Bjorn Andersson 2015-06-26 460 * Allocate space for a given smem item of size @size, given that the item is
4b638df4c9d556 Bjorn Andersson 2015-06-26 461 * not yet allocated.
4b638df4c9d556 Bjorn Andersson 2015-06-26 462 */
4b638df4c9d556 Bjorn Andersson 2015-06-26 463 int qcom_smem_alloc(unsigned host, unsigned item, size_t size)
4b638df4c9d556 Bjorn Andersson 2015-06-26 464 {
d52e404874369f Chris Lew 2017-10-11 465 struct smem_partition_header *phdr;
412ae5100f1356 nanli2x 2020-09-22 466 struct smem_ptable_entry *entry;
4b638df4c9d556 Bjorn Andersson 2015-06-26 467 unsigned long flags;
4b638df4c9d556 Bjorn Andersson 2015-06-26 468 int ret;
4b638df4c9d556 Bjorn Andersson 2015-06-26 469
4b638df4c9d556 Bjorn Andersson 2015-06-26 470 if (!__smem)
4b638df4c9d556 Bjorn Andersson 2015-06-26 471 return -EPROBE_DEFER;
4b638df4c9d556 Bjorn Andersson 2015-06-26 472
4b638df4c9d556 Bjorn Andersson 2015-06-26 473 if (item < SMEM_ITEM_LAST_FIXED) {
4b638df4c9d556 Bjorn Andersson 2015-06-26 474 dev_err(__smem->dev,
4b638df4c9d556 Bjorn Andersson 2015-06-26 475 "Rejecting allocation of static entry %d\n", item);
4b638df4c9d556 Bjorn Andersson 2015-06-26 476 return -EINVAL;
4b638df4c9d556 Bjorn Andersson 2015-06-26 477 }
4b638df4c9d556 Bjorn Andersson 2015-06-26 478
5b3940676107dd Chris Lew 2017-10-11 479 if (WARN_ON(item >= __smem->item_count))
5b3940676107dd Chris Lew 2017-10-11 480 return -EINVAL;
5b3940676107dd Chris Lew 2017-10-11 481
4b638df4c9d556 Bjorn Andersson 2015-06-26 482 ret = hwspin_lock_timeout_irqsave(__smem->hwlock,
4b638df4c9d556 Bjorn Andersson 2015-06-26 483 HWSPINLOCK_TIMEOUT,
4b638df4c9d556 Bjorn Andersson 2015-06-26 484 &flags);
4b638df4c9d556 Bjorn Andersson 2015-06-26 485 if (ret)
4b638df4c9d556 Bjorn Andersson 2015-06-26 486 return ret;
4b638df4c9d556 Bjorn Andersson 2015-06-26 487
412ae5100f1356 nanli2x 2020-09-22 488 if (host < SMEM_HOST_COUNT && __smem->ptable_entries[host]) {
412ae5100f1356 nanli2x 2020-09-22 489 entry = __smem->ptable_entries[host];
412ae5100f1356 nanli2x 2020-09-22 490 ret = qcom_smem_alloc_private(__smem, entry, item, size);
d52e404874369f Chris Lew 2017-10-11 @491 } else if (__smem->global_partition) {
412ae5100f1356 nanli2x 2020-09-22 @492 entry = __smem->global_ptable_entries[host];
412ae5100f1356 nanli2x 2020-09-22 493 ret = qcom_smem_alloc_private(__smem, entry, item, size);
d52e404874369f Chris Lew 2017-10-11 494 } else {
4b638df4c9d556 Bjorn Andersson 2015-06-26 495 ret = qcom_smem_alloc_global(__smem, item, size);
d52e404874369f Chris Lew 2017-10-11 496 }
4b638df4c9d556 Bjorn Andersson 2015-06-26 497
4b638df4c9d556 Bjorn Andersson 2015-06-26 498 hwspin_unlock_irqrestore(__smem->hwlock, &flags);
4b638df4c9d556 Bjorn Andersson 2015-06-26 499
4b638df4c9d556 Bjorn Andersson 2015-06-26 500 return ret;
4b638df4c9d556 Bjorn Andersson 2015-06-26 501 }
4b638df4c9d556 Bjorn Andersson 2015-06-26 502 EXPORT_SYMBOL(qcom_smem_alloc);
4b638df4c9d556 Bjorn Andersson 2015-06-26 503
1a03964dec3cec Stephen Boyd 2015-09-02 504 static void *qcom_smem_get_global(struct qcom_smem *smem,
4b638df4c9d556 Bjorn Andersson 2015-06-26 505 unsigned item,
4b638df4c9d556 Bjorn Andersson 2015-06-26 506 size_t *size)
4b638df4c9d556 Bjorn Andersson 2015-06-26 507 {
412ae5100f1356 nanli2x 2020-09-22 508 struct smem_global_entry *entry;
4b638df4c9d556 Bjorn Andersson 2015-06-26 509 struct smem_header *header;
4b638df4c9d556 Bjorn Andersson 2015-06-26 510 struct smem_region *area;
412ae5100f1356 nanli2x 2020-09-22 511 u64 entry_offset;
412ae5100f1356 nanli2x 2020-09-22 512 u32 e_size;
4b638df4c9d556 Bjorn Andersson 2015-06-26 513 u32 aux_base;
4b638df4c9d556 Bjorn Andersson 2015-06-26 514 unsigned i;
4b638df4c9d556 Bjorn Andersson 2015-06-26 515
4b638df4c9d556 Bjorn Andersson 2015-06-26 516 header = smem->regions[0].virt_base;
4b638df4c9d556 Bjorn Andersson 2015-06-26 517 entry = &header->toc[item];
4b638df4c9d556 Bjorn Andersson 2015-06-26 518 if (!entry->allocated)
1a03964dec3cec Stephen Boyd 2015-09-02 519 return ERR_PTR(-ENXIO);
4b638df4c9d556 Bjorn Andersson 2015-06-26 520
9806884d8cd552 Stephen Boyd 2015-09-02 521 aux_base = le32_to_cpu(entry->aux_base) & AUX_BASE_MASK;
4b638df4c9d556 Bjorn Andersson 2015-06-26 522
4b638df4c9d556 Bjorn Andersson 2015-06-26 523 for (i = 0; i < smem->num_regions; i++) {
4b638df4c9d556 Bjorn Andersson 2015-06-26 524 area = &smem->regions[i];
4b638df4c9d556 Bjorn Andersson 2015-06-26 525
4b638df4c9d556 Bjorn Andersson 2015-06-26 526 if (area->aux_base == aux_base || !aux_base) {
412ae5100f1356 nanli2x 2020-09-22 527 e_size = le32_to_cpu(entry->size);
412ae5100f1356 nanli2x 2020-09-22 528 entry_offset = le32_to_cpu(entry->offset);
412ae5100f1356 nanli2x 2020-09-22 529
412ae5100f1356 nanli2x 2020-09-22 530 if (WARN_ON(e_size + entry_offset > area->size))
412ae5100f1356 nanli2x 2020-09-22 531 return ERR_PTR(-EINVAL);
412ae5100f1356 nanli2x 2020-09-22 532
4b638df4c9d556 Bjorn Andersson 2015-06-26 533 if (size != NULL)
412ae5100f1356 nanli2x 2020-09-22 534 *size = e_size;
412ae5100f1356 nanli2x 2020-09-22 535
412ae5100f1356 nanli2x 2020-09-22 536 return area->virt_base + entry_offset;
1a03964dec3cec Stephen Boyd 2015-09-02 537 }
1a03964dec3cec Stephen Boyd 2015-09-02 538 }
4b638df4c9d556 Bjorn Andersson 2015-06-26 539
1a03964dec3cec Stephen Boyd 2015-09-02 540 return ERR_PTR(-ENOENT);
4b638df4c9d556 Bjorn Andersson 2015-06-26 541 }
4b638df4c9d556 Bjorn Andersson 2015-06-26 542
1a03964dec3cec Stephen Boyd 2015-09-02 543 static void *qcom_smem_get_private(struct qcom_smem *smem,
412ae5100f1356 nanli2x 2020-09-22 544 struct smem_ptable_entry *entry,
d52e404874369f Chris Lew 2017-10-11 545 size_t cacheline,
4b638df4c9d556 Bjorn Andersson 2015-06-26 546 unsigned item,
4b638df4c9d556 Bjorn Andersson 2015-06-26 547 size_t *size)
4b638df4c9d556 Bjorn Andersson 2015-06-26 548 {
412ae5100f1356 nanli2x 2020-09-22 @549 struct smem_partition_header *phdr
9806884d8cd552 Stephen Boyd 2015-09-02 550 struct smem_private_entry *e, *end;
412ae5100f1356 nanli2x 2020-09-22 551 void *item_ptr, *p_end;
412ae5100f1356 nanli2x 2020-09-22 552 u32 partition_size;
412ae5100f1356 nanli2x 2020-09-22 553 u32 padding_data;
412ae5100f1356 nanli2x 2020-09-22 554 u32 e_size;
412ae5100f1356 nanli2x 2020-09-22 555
412ae5100f1356 nanli2x 2020-09-22 @556 phdr = ptable_entry_to_phdr(entry);
412ae5100f1356 nanli2x 2020-09-22 557 partition_size = le32_to_cpu(entry->size);
412ae5100f1356 nanli2x 2020-09-22 558 p_end = (void *)phdr + partition_size;
c7c1dc35871378 Bjorn Andersson 2017-10-04 559
01f141544413aa Bjorn Andersson 2017-10-04 560 e = phdr_to_first_uncached_entry(phdr);
01f141544413aa Bjorn Andersson 2017-10-04 561 end = phdr_to_last_uncached_entry(phdr);
412ae5100f1356 nanli2x 2020-09-22 562 if (WARN_ON((void *)end > p_end))
412ae5100f1356 nanli2x 2020-09-22 563 return ERR_PTR(-EINVAL);
4b638df4c9d556 Bjorn Andersson 2015-06-26 564
9806884d8cd552 Stephen Boyd 2015-09-02 565 while (e < end) {
c7c1dc35871378 Bjorn Andersson 2017-10-04 566 if (e->canary != SMEM_PRIVATE_CANARY)
c7c1dc35871378 Bjorn Andersson 2017-10-04 567 goto invalid_canary;
4b638df4c9d556 Bjorn Andersson 2015-06-26 568
9806884d8cd552 Stephen Boyd 2015-09-02 569 if (le16_to_cpu(e->item) == item) {
412ae5100f1356 nanli2x 2020-09-22 570 if (size != NULL) {
412ae5100f1356 nanli2x 2020-09-22 571 e_size = le32_to_cpu(e->size);
412ae5100f1356 nanli2x 2020-09-22 572 padding_data = le16_to_cpu(e->padding_data);
4b638df4c9d556 Bjorn Andersson 2015-06-26 573
412ae5100f1356 nanli2x 2020-09-22 574 if (e_size < partition_size
412ae5100f1356 nanli2x 2020-09-22 575 && padding_data < e_size)
412ae5100f1356 nanli2x 2020-09-22 576 *size = e_size - padding_data;
412ae5100f1356 nanli2x 2020-09-22 577 else
412ae5100f1356 nanli2x 2020-09-22 578 return ERR_PTR(-EINVAL);
4b638df4c9d556 Bjorn Andersson 2015-06-26 579 }
4b638df4c9d556 Bjorn Andersson 2015-06-26 580
412ae5100f1356 nanli2x 2020-09-22 @581 item_ptr = entry_to_item(e);
412ae5100f1356 nanli2x 2020-09-22 582 if (WARN_ON(item_ptr > p_end))
412ae5100f1356 nanli2x 2020-09-22 583 return ERR_PTR(-EINVAL);
412ae5100f1356 nanli2x 2020-09-22 584
412ae5100f1356 nanli2x 2020-09-22 585 return item_ptr;
412ae5100f1356 nanli2x 2020-09-22 586 }
01f141544413aa Bjorn Andersson 2017-10-04 587 e = uncached_entry_next(e);
4b638df4c9d556 Bjorn Andersson 2015-06-26 588 }
412ae5100f1356 nanli2x 2020-09-22 589 if (WARN_ON((void *)e > p_end))
412ae5100f1356 nanli2x 2020-09-22 590 return ERR_PTR(-EINVAL);
4b638df4c9d556 Bjorn Andersson 2015-06-26 591
c7c1dc35871378 Bjorn Andersson 2017-10-04 592 /* Item was not found in the uncached list, search the cached list */
c7c1dc35871378 Bjorn Andersson 2017-10-04 593
c7c1dc35871378 Bjorn Andersson 2017-10-04 594 e = phdr_to_first_cached_entry(phdr, cacheline);
c7c1dc35871378 Bjorn Andersson 2017-10-04 595 end = phdr_to_last_cached_entry(phdr);
c7c1dc35871378 Bjorn Andersson 2017-10-04 596
c7c1dc35871378 Bjorn Andersson 2017-10-04 597 while (e > end) {
c7c1dc35871378 Bjorn Andersson 2017-10-04 598 if (e->canary != SMEM_PRIVATE_CANARY)
c7c1dc35871378 Bjorn Andersson 2017-10-04 599 goto invalid_canary;
c7c1dc35871378 Bjorn Andersson 2017-10-04 600
c7c1dc35871378 Bjorn Andersson 2017-10-04 601 if (le16_to_cpu(e->item) == item) {
c7c1dc35871378 Bjorn Andersson 2017-10-04 602 if (size != NULL)
c7c1dc35871378 Bjorn Andersson 2017-10-04 603 *size = le32_to_cpu(e->size) -
c7c1dc35871378 Bjorn Andersson 2017-10-04 604 le16_to_cpu(e->padding_data);
c7c1dc35871378 Bjorn Andersson 2017-10-04 605
c7c1dc35871378 Bjorn Andersson 2017-10-04 606 return cached_entry_to_item(e);
c7c1dc35871378 Bjorn Andersson 2017-10-04 607 }
c7c1dc35871378 Bjorn Andersson 2017-10-04 608
c7c1dc35871378 Bjorn Andersson 2017-10-04 609 e = cached_entry_next(e, cacheline);
c7c1dc35871378 Bjorn Andersson 2017-10-04 610 }
c7c1dc35871378 Bjorn Andersson 2017-10-04 611
1a03964dec3cec Stephen Boyd 2015-09-02 612 return ERR_PTR(-ENOENT);
c7c1dc35871378 Bjorn Andersson 2017-10-04 613
c7c1dc35871378 Bjorn Andersson 2017-10-04 614 invalid_canary:
04a512fea33336 Alex Elder 2018-04-10 615 dev_err(smem->dev, "Found invalid canary in hosts %hu:%hu partition\n",
04a512fea33336 Alex Elder 2018-04-10 616 le16_to_cpu(phdr->host0), le16_to_cpu(phdr->host1));
c7c1dc35871378 Bjorn Andersson 2017-10-04 617
c7c1dc35871378 Bjorn Andersson 2017-10-04 618 return ERR_PTR(-EINVAL);
4b638df4c9d556 Bjorn Andersson 2015-06-26 619 }
4b638df4c9d556 Bjorn Andersson 2015-06-26 620
:::::: The code at line 491 was first introduced by commit
:::::: d52e404874369f10d20519f4095478d9cb4d6aad soc: qcom: smem: Support global partition
:::::: TO: Chris Lew <clew@codeaurora.org>
:::::: CC: Andy Gross <andy.gross@linaro.org>
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 40507 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-03-07 12:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-03-07 12:50 [intel-linux-intel-lts:4.19/android 8/8] drivers/soc/qcom/smem.c:491:19: error: 'struct qcom_smem' has no member named 'global_partition' kernel test robot
-- strict thread matches above, loose matches on Subject: below --
2020-11-04 5:01 kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.