diff for duplicates of <202609241805.VsLzGPLn-lkp@intel.com> diff --git a/a/1.txt b/N1/1.txt index a0a86c4..06e2a07 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,14 +1,6 @@ -BCC: lkp@intel.com -CC: oe-kbuild-all@lists.linux.dev -CC: linux-kernel@vger.kernel.org -TO: Arnd Bergmann <arnd@arndb.de> - tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: 62f4c998b297cf233997a2b4cd6fc2d2df0319c9 commit: d70242427110123b65c095594eb74a703d3af156 ARM: rework ARM11 CPU selection logic -date: 3 months ago -:::::: branch date: 19 hours ago -:::::: commit date: 3 months ago config: arm-randconfig-r2200-20260924 (https://download.01.org/0day-ci/archive/20260924/202609241805.VsLzGPLn-lkp@intel.com/config) compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0 smatch: v0.5.0-9187-g5189e3fb @@ -21,39 +13,53 @@ the same patch/commit), kindly add following tags | Closes: https://lore.kernel.org/r/202609241805.VsLzGPLn-lkp@intel.com/ smatch warnings: -drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12' drivers/xen/privcmd.c:488 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * 8' '0-u32max * 8' drivers/xen/privcmd.c:495 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * (4)' '0-u32max * 4' vim +817 drivers/xen/gntdev.c + 470 static long privcmd_ioctl_mmap_batch( + 471 struct file *file, void __user *udata, int version) + 472 { + 473 struct privcmd_data *data = file->private_data; + 474 int ret; + 475 struct privcmd_mmapbatch_v2 m; + 476 struct mm_struct *mm = current->mm; + 477 struct vm_area_struct *vma; + 478 unsigned long nr_pages; + 479 LIST_HEAD(pagelist); + 480 struct mmap_batch_state state; + 481 + 482 switch (version) { + 483 case 1: + 484 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch))) + 485 return -EFAULT; + 486 /* Returns per-frame error in m.arr. */ + 487 m.err = NULL; + 488 if (!access_ok(m.arr, m.num * sizeof(*m.arr))) + ^^^^^^^^^^^^^^^^^^^^^^ -bdc612dc6903c4 Daniel De Graaf 2011-02-03 802 -a4cdb556cae05c David Vrabel 2014-12-02 803 static int gntdev_get_page(struct gntdev_copy_batch *batch, void __user *virt, -779055842da5b2 Souptick Joarder 2020-09-06 804 unsigned long *gfn) -a4cdb556cae05c David Vrabel 2014-12-02 805 { -a4cdb556cae05c David Vrabel 2014-12-02 806 unsigned long addr = (unsigned long)virt; -a4cdb556cae05c David Vrabel 2014-12-02 807 struct page *page; -a4cdb556cae05c David Vrabel 2014-12-02 808 unsigned long xen_pfn; -a4cdb556cae05c David Vrabel 2014-12-02 809 int ret; -a4cdb556cae05c David Vrabel 2014-12-02 810 -d6bbc2ff68fd22 Souptick Joarder 2020-09-06 811 ret = pin_user_pages_fast(addr, 1, batch->writeable ? FOLL_WRITE : 0, &page); -a4cdb556cae05c David Vrabel 2014-12-02 812 if (ret < 0) -a4cdb556cae05c David Vrabel 2014-12-02 813 return ret; -a4cdb556cae05c David Vrabel 2014-12-02 814 -a4cdb556cae05c David Vrabel 2014-12-02 815 batch->pages[batch->nr_pages++] = page; -a4cdb556cae05c David Vrabel 2014-12-02 816 -a4cdb556cae05c David Vrabel 2014-12-02 @817 xen_pfn = page_to_xen_pfn(page) + XEN_PFN_DOWN(addr & ~PAGE_MASK); -a4cdb556cae05c David Vrabel 2014-12-02 818 *gfn = pfn_to_gfn(xen_pfn); -a4cdb556cae05c David Vrabel 2014-12-02 819 -a4cdb556cae05c David Vrabel 2014-12-02 820 return 0; -a4cdb556cae05c David Vrabel 2014-12-02 821 } -a4cdb556cae05c David Vrabel 2014-12-02 822 + 489 return -EFAULT; + 490 break; + 491 case 2: + 492 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2))) + 493 return -EFAULT; + 494 /* Returns per-frame error code in m.err. */ + 495 if (!access_ok(m.err, m.num * (sizeof(*m.err)))) + ^^^^^^^^^^^^^^^^^^^^^^^ +These integer overflow bugs are from 2012, but I guess your patch exposed +the arm32 build to the zero day bot. The bugs only affect 32bit systems. -:::::: The code at line 817 was first introduced by commit -:::::: a4cdb556cae05cd3e7b602b3a44c01420c4e2258 xen/gntdev: add ioctl for grant copy + 496 return -EFAULT; + 497 break; + 498 default: + 499 return -EINVAL; + 500 } + 501 + 502 /* If restriction is in place, check the domid matches */ + 503 if (data->domid != DOMID_INVALID && data->domid != m.dom) + 504 return -EPERM; + 505 -:::::: TO: David Vrabel <david.vrabel@citrix.com> -:::::: CC: David Vrabel <david.vrabel@citrix.com> -- 0-DAY CI Kernel Test Service diff --git a/a/content_digest b/N1/content_digest index 402ebb0..19e6004 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,22 +1,16 @@ - "From\0kernel test robot <lkp@intel.com>\0" + "From\0Dan Carpenter <error27@gmail.com>\0" "Subject\0drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'\0" - "Date\0Thu, 24 Sep 2026 18:34:06 +0200\0" - "To\0oe-kbuild@lists.linux.dev\0" + "Date\0Thu, 24 Sep 2026 22:39:41 +0300\0" + "To\0oe-kbuild@lists.linux.dev" + " Arnd Bergmann <arnd@arndb.de>\0" "Cc\0lkp@intel.com" - " Dan Carpenter <error27@gmail.com>\0" + oe-kbuild-all@lists.linux.dev + " linux-kernel@vger.kernel.org\0" "\00:1\0" "b\0" - "BCC: lkp@intel.com\n" - "CC: oe-kbuild-all@lists.linux.dev\n" - "CC: linux-kernel@vger.kernel.org\n" - "TO: Arnd Bergmann <arnd@arndb.de>\n" - "\n" "tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master\n" "head: 62f4c998b297cf233997a2b4cd6fc2d2df0319c9\n" "commit: d70242427110123b65c095594eb74a703d3af156 ARM: rework ARM11 CPU selection logic\n" - "date: 3 months ago\n" - ":::::: branch date: 19 hours ago\n" - ":::::: commit date: 3 months ago\n" "config: arm-randconfig-r2200-20260924 (https://download.01.org/0day-ci/archive/20260924/202609241805.VsLzGPLn-lkp@intel.com/config)\n" "compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0\n" "smatch: v0.5.0-9187-g5189e3fb\n" @@ -29,42 +23,56 @@ "| Closes: https://lore.kernel.org/r/202609241805.VsLzGPLn-lkp@intel.com/\n" "\n" "smatch warnings:\n" - "drivers/xen/gntdev.c:817 gntdev_get_page() warn: mask and shift to zero: expr='(addr & ~(~((1 << 12) - 1))) >> 12'\n" "drivers/xen/privcmd.c:488 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * 8' '0-u32max * 8'\n" "drivers/xen/privcmd.c:495 privcmd_ioctl_mmap_batch() warn: potential user controlled sizeof overflow 'm.num * (4)' '0-u32max * 4'\n" "\n" "vim +817 drivers/xen/gntdev.c\n" + " 470 static long privcmd_ioctl_mmap_batch(\n" + " 471 struct file *file, void __user *udata, int version)\n" + " 472 {\n" + " 473 struct privcmd_data *data = file->private_data;\n" + " 474 int ret;\n" + " 475 struct privcmd_mmapbatch_v2 m;\n" + " 476 struct mm_struct *mm = current->mm;\n" + " 477 struct vm_area_struct *vma;\n" + " 478 unsigned long nr_pages;\n" + " 479 LIST_HEAD(pagelist);\n" + " 480 struct mmap_batch_state state;\n" + " 481 \n" + " 482 switch (version) {\n" + " 483 case 1:\n" + " 484 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch)))\n" + " 485 return -EFAULT;\n" + " 486 /* Returns per-frame error in m.arr. */\n" + " 487 m.err = NULL;\n" + " 488 if (!access_ok(m.arr, m.num * sizeof(*m.arr)))\n" + " ^^^^^^^^^^^^^^^^^^^^^^\n" "\n" - "bdc612dc6903c4 Daniel De Graaf 2011-02-03 802 \n" - "a4cdb556cae05c David Vrabel 2014-12-02 803 static int gntdev_get_page(struct gntdev_copy_batch *batch, void __user *virt,\n" - "779055842da5b2 Souptick Joarder 2020-09-06 804 \t\t\t\tunsigned long *gfn)\n" - "a4cdb556cae05c David Vrabel 2014-12-02 805 {\n" - "a4cdb556cae05c David Vrabel 2014-12-02 806 \tunsigned long addr = (unsigned long)virt;\n" - "a4cdb556cae05c David Vrabel 2014-12-02 807 \tstruct page *page;\n" - "a4cdb556cae05c David Vrabel 2014-12-02 808 \tunsigned long xen_pfn;\n" - "a4cdb556cae05c David Vrabel 2014-12-02 809 \tint ret;\n" - "a4cdb556cae05c David Vrabel 2014-12-02 810 \n" - "d6bbc2ff68fd22 Souptick Joarder 2020-09-06 811 \tret = pin_user_pages_fast(addr, 1, batch->writeable ? FOLL_WRITE : 0, &page);\n" - "a4cdb556cae05c David Vrabel 2014-12-02 812 \tif (ret < 0)\n" - "a4cdb556cae05c David Vrabel 2014-12-02 813 \t\treturn ret;\n" - "a4cdb556cae05c David Vrabel 2014-12-02 814 \n" - "a4cdb556cae05c David Vrabel 2014-12-02 815 \tbatch->pages[batch->nr_pages++] = page;\n" - "a4cdb556cae05c David Vrabel 2014-12-02 816 \n" - "a4cdb556cae05c David Vrabel 2014-12-02 @817 \txen_pfn = page_to_xen_pfn(page) + XEN_PFN_DOWN(addr & ~PAGE_MASK);\n" - "a4cdb556cae05c David Vrabel 2014-12-02 818 \t*gfn = pfn_to_gfn(xen_pfn);\n" - "a4cdb556cae05c David Vrabel 2014-12-02 819 \n" - "a4cdb556cae05c David Vrabel 2014-12-02 820 \treturn 0;\n" - "a4cdb556cae05c David Vrabel 2014-12-02 821 }\n" - "a4cdb556cae05c David Vrabel 2014-12-02 822 \n" + " 489 return -EFAULT;\n" + " 490 break;\n" + " 491 case 2:\n" + " 492 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2)))\n" + " 493 return -EFAULT;\n" + " 494 /* Returns per-frame error code in m.err. */\n" + " 495 if (!access_ok(m.err, m.num * (sizeof(*m.err))))\n" + " ^^^^^^^^^^^^^^^^^^^^^^^\n" + "These integer overflow bugs are from 2012, but I guess your patch exposed\n" + "the arm32 build to the zero day bot. The bugs only affect 32bit systems.\n" "\n" - ":::::: The code at line 817 was first introduced by commit\n" - ":::::: a4cdb556cae05cd3e7b602b3a44c01420c4e2258 xen/gntdev: add ioctl for grant copy\n" + " 496 return -EFAULT;\n" + " 497 break;\n" + " 498 default:\n" + " 499 return -EINVAL;\n" + " 500 }\n" + " 501 \n" + " 502 /* If restriction is in place, check the domid matches */\n" + " 503 if (data->domid != DOMID_INVALID && data->domid != m.dom)\n" + " 504 return -EPERM;\n" + " 505 \n" "\n" - ":::::: TO: David Vrabel <david.vrabel@citrix.com>\n" - ":::::: CC: David Vrabel <david.vrabel@citrix.com>\n" "\n" "--\n" "0-DAY CI Kernel Test Service\n" https://github.com/intel/lkp-tests/wiki -5590e80ac4fc47506d3432582cff8e0f7fab879d9ef50f1435bdf319a7eab8c6 +40d43501a3b681cb387f414f42e902a97c0a6af5e0bae28460e8b67db1e9745e
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.