[PATCH 5.10.y] scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity

[PATCH 5.10.y] scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity

[Kuan-Wei Chiu]

The orc_sort_cmp() function, used with qsort(), previously violated the
symmetry and transitivity rules required by the C standard.  Specifically,
when both entries are ORC_REG_UNDEFINED, it could result in both a < b
and b < a, which breaks the required symmetry and transitivity.  This can
lead to undefined behavior and incorrect sorting results, potentially
causing memory corruption in glibc implementations [1].

Symmetry: If x < y, then y > x.
Transitivity: If x < y and y < z, then x < z.

Fix the comparison logic to return 0 when both entries are
ORC_REG_UNDEFINED, ensuring compliance with qsort() requirements.

Link: https://www.qualys.com/2024/01/30/qsort.txt [1]
Link: https://lkml.kernel.org/r/20241226140332.2670689-1-visitorckw@gmail.com
Fixes: 57fa18994285 ("scripts/sorttable: Implement build-time ORC unwind table sorting")
Fixes: fb799447ae29 ("x86,objtool: Split UNWIND_HINT_EMPTY in two")
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Cc: Ching-Chun (Jim) Huang <jserv@ccns.ncku.edu.tw>
Cc: <chuang@cs.nycu.edu.tw>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Josh Poimboeuf <jpoimboe@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Shile Zhang <shile.zhang@linux.alibaba.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 0210d251162f4033350a94a43f95b1c39ec84a90)
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
---
 scripts/sorttable.h | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/scripts/sorttable.h b/scripts/sorttable.h
index a2baa2fefb13..fb385d0f3cc2 100644
--- a/scripts/sorttable.h
+++ b/scripts/sorttable.h
@@ -103,7 +103,7 @@ static inline unsigned long orc_ip(const int *ip)
 
 static int orc_sort_cmp(const void *_a, const void *_b)
 {
-	struct orc_entry *orc_a;
+	struct orc_entry *orc_a, *orc_b;
 	const int *a = g_orc_ip_table + *(int *)_a;
 	const int *b = g_orc_ip_table + *(int *)_b;
 	unsigned long a_val = orc_ip(a);
@@ -120,8 +120,12 @@ static int orc_sort_cmp(const void *_a, const void *_b)
 	 * These terminator entries exist to handle any gaps created by
 	 * whitelisted .o files which didn't get objtool generation.
 	 */
-	orc_a = g_orc_table + (a - g_orc_ip_table);
-	return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
+ 	orc_a = g_orc_table + (a - g_orc_ip_table);
+	orc_b = g_orc_table + (b - g_orc_ip_table);
+	if (orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end &&
+	    orc_b->sp_reg == ORC_REG_UNDEFINED && !orc_b->end)
+		return 0;
+ 	return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
 }
 
 static void *sort_orctable(void *arg)
-- 
2.34.1

Re: [PATCH 5.10.y] scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

Found matching upstream commit: 0210d251162f4033350a94a43f95b1c39ec84a90


Status in newer kernel trees:
6.12.y | Not found
6.6.y | Not found
6.1.y | Not found
5.15.y | Not found
5.10.y | Not found

Note: The patch differs from the upstream commit:
---
1:  0210d251162f ! 1:  e4b874815eaf scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity
    @@ Commit message
     
         The orc_sort_cmp() function, used with qsort(), previously violated the
         symmetry and transitivity rules required by the C standard.  Specifically,
    -    when both entries are ORC_TYPE_UNDEFINED, it could result in both a < b
    +    when both entries are ORC_REG_UNDEFINED, it could result in both a < b
         and b < a, which breaks the required symmetry and transitivity.  This can
         lead to undefined behavior and incorrect sorting results, potentially
         causing memory corruption in glibc implementations [1].
    @@ Commit message
         Transitivity: If x < y and y < z, then x < z.
     
         Fix the comparison logic to return 0 when both entries are
    -    ORC_TYPE_UNDEFINED, ensuring compliance with qsort() requirements.
    +    ORC_REG_UNDEFINED, ensuring compliance with qsort() requirements.
     
         Link: https://www.qualys.com/2024/01/30/qsort.txt [1]
         Link: https://lkml.kernel.org/r/20241226140332.2670689-1-visitorckw@gmail.com
    @@ Commit message
         Cc: Steven Rostedt <rostedt@goodmis.org>
         Cc: <stable@vger.kernel.org>
         Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    +    (cherry picked from commit 0210d251162f4033350a94a43f95b1c39ec84a90)
    +    Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
     
      ## scripts/sorttable.h ##
     @@ scripts/sorttable.h: static inline unsigned long orc_ip(const int *ip)
    @@ scripts/sorttable.h: static inline unsigned long orc_ip(const int *ip)
      	const int *b = g_orc_ip_table + *(int *)_b;
      	unsigned long a_val = orc_ip(a);
     @@ scripts/sorttable.h: static int orc_sort_cmp(const void *_a, const void *_b)
    + 	 * These terminator entries exist to handle any gaps created by
      	 * whitelisted .o files which didn't get objtool generation.
      	 */
    - 	orc_a = g_orc_table + (a - g_orc_ip_table);
    +-	orc_a = g_orc_table + (a - g_orc_ip_table);
    +-	return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
    ++ 	orc_a = g_orc_table + (a - g_orc_ip_table);
     +	orc_b = g_orc_table + (b - g_orc_ip_table);
    -+	if (orc_a->type == ORC_TYPE_UNDEFINED && orc_b->type == ORC_TYPE_UNDEFINED)
    ++	if (orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end &&
    ++	    orc_b->sp_reg == ORC_REG_UNDEFINED && !orc_b->end)
     +		return 0;
    - 	return orc_a->type == ORC_TYPE_UNDEFINED ? -1 : 1;
    ++ 	return orc_a->sp_reg == ORC_REG_UNDEFINED && !orc_a->end ? -1 : 1;
      }
      
    + static void *sort_orctable(void *arg)
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.10.y       |  Success    |  Success   |