[PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when error status data has multiple sections

[PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when error status data has multiple sections

[shiju.jose]

From: Shiju Jose <shiju.jose@huawei.com>

ghes_handle_aer() passes AER data to the PCI core for logging and
recovery by calling aer_recover_queue() with a pointer to struct
aer_capability_regs.

The problem was that aer_recover_queue() queues the pointer directly
without copying the aer_capability_regs data.  The pointer was to
the ghes->estatus buffer, which could be reused before
aer_recover_work_func() reads the data.

To avoid this problem, allocate a new aer_capability_regs structure
from the ghes_estatus_pool, copy the AER data from the ghes->estatus
buffer into it, pass a pointer to the new struct to
aer_recover_queue(), and free it after aer_recover_work_func() has
processed it.

Reported-by: Bjorn Helgaas <helgaas@kernel.org>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
---
Changes from v1 to v2:
1. Updated patch description with the description Bjorn has suggested.  
2. Add Acked-by: Bjorn Helgaas <bhelgaas@google.com>.
---
 drivers/acpi/apei/ghes.c | 23 ++++++++++++++++++++++-
 drivers/pci/pcie/aer.c   | 10 ++++++++++
 include/acpi/ghes.h      |  1 +
 3 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index ef59d6ea16da..63ad0541db38 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -209,6 +209,20 @@ int ghes_estatus_pool_init(unsigned int num_ghes)
 	return -ENOMEM;
 }
 
+/**
+ * ghes_estatus_pool_region_free - free previously allocated memory
+ *				   from the ghes_estatus_pool.
+ * @addr: address of memory to free.
+ * @size: size of memory to free.
+ *
+ * Returns none.
+ */
+void ghes_estatus_pool_region_free(unsigned long addr, u32 size)
+{
+	gen_pool_free(ghes_estatus_pool, addr, size);
+}
+EXPORT_SYMBOL_GPL(ghes_estatus_pool_region_free);
+
 static int map_gen_v2(struct ghes *ghes)
 {
 	return apei_map_generic_address(&ghes->generic_v2->read_ack_register);
@@ -564,6 +578,7 @@ static void ghes_handle_aer(struct acpi_hest_generic_data *gdata)
 	    pcie_err->validation_bits & CPER_PCIE_VALID_AER_INFO) {
 		unsigned int devfn;
 		int aer_severity;
+		u8 *aer_info;
 
 		devfn = PCI_DEVFN(pcie_err->device_id.device,
 				  pcie_err->device_id.function);
@@ -577,11 +592,17 @@ static void ghes_handle_aer(struct acpi_hest_generic_data *gdata)
 		if (gdata->flags & CPER_SEC_RESET)
 			aer_severity = AER_FATAL;
 
+		aer_info = (void *)gen_pool_alloc(ghes_estatus_pool,
+						  sizeof(struct aer_capability_regs));
+		if (!aer_info)
+			return;
+		memcpy(aer_info, pcie_err->aer_info, sizeof(struct aer_capability_regs));
+
 		aer_recover_queue(pcie_err->device_id.segment,
 				  pcie_err->device_id.bus,
 				  devfn, aer_severity,
 				  (struct aer_capability_regs *)
-				  pcie_err->aer_info);
+				  aer_info);
 	}
 #endif
 }
diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
index e85ff946e8c8..388b614c11fd 100644
--- a/drivers/pci/pcie/aer.c
+++ b/drivers/pci/pcie/aer.c
@@ -29,6 +29,7 @@
 #include <linux/kfifo.h>
 #include <linux/slab.h>
 #include <acpi/apei.h>
+#include <acpi/ghes.h>
 #include <ras/ras_event.h>
 
 #include "../pci.h"
@@ -996,6 +997,15 @@ static void aer_recover_work_func(struct work_struct *work)
 			continue;
 		}
 		cper_print_aer(pdev, entry.severity, entry.regs);
+		/*
+		 * Memory for aer_capability_regs(entry.regs) is being allocated from the
+		 * ghes_estatus_pool to protect it from overwriting when multiple sections
+		 * are present in the error status. Thus free the same after processing
+		 * the data.
+		 */
+		ghes_estatus_pool_region_free((unsigned long)entry.regs,
+					      sizeof(struct aer_capability_regs));
+
 		if (entry.severity == AER_NONFATAL)
 			pcie_do_recovery(pdev, pci_channel_io_normal,
 					 aer_root_reset);
diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
index 3c8bba9f1114..40d89e161076 100644
--- a/include/acpi/ghes.h
+++ b/include/acpi/ghes.h
@@ -78,6 +78,7 @@ static inline struct list_head *ghes_get_devices(void) { return NULL; }
 #endif
 
 int ghes_estatus_pool_init(unsigned int num_ghes);
+void ghes_estatus_pool_region_free(unsigned long addr, u32 size);
 
 static inline int acpi_hest_get_version(struct acpi_hest_generic_data *gdata)
 {
-- 
2.34.1

Re: [PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when error status data has multiple sections

[kernel test robot]

Hi,

kernel test robot noticed the following build errors:

[auto build test ERROR on rafael-pm/linux-next]
[also build test ERROR on pci/next pci/for-linus linus/master v6.6-rc2 next-20230919]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/shiju-jose-huawei-com/ACPI-APEI-Fix-for-overwriting-AER-info-when-error-status-data-has-multiple-sections/20230919-171718
base:   https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git linux-next
patch link:    https://lore.kernel.org/r/20230919091543.794-1-shiju.jose%40huawei.com
patch subject: [PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when error status data has multiple sections
config: i386-buildonly-randconfig-006-20230920 (https://download.01.org/0day-ci/archive/20230920/202309201046.jwWoGRvA-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230920/202309201046.jwWoGRvA-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202309201046.jwWoGRvA-lkp@intel.com/

All errors (new ones prefixed by >>):

   ld: drivers/pci/pcie/aer.o: in function `aer_recover_work_func':
>> aer.c:(.text+0xec5): undefined reference to `ghes_estatus_pool_region_free'

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when error status data has multiple sections

[Rafael J. Wysocki]

On Tue, Sep 19, 2023 at 11:16 AM <shiju.jose@huawei.com> wrote:
>
> From: Shiju Jose <shiju.jose@huawei.com>
>
> ghes_handle_aer() passes AER data to the PCI core for logging and
> recovery by calling aer_recover_queue() with a pointer to struct
> aer_capability_regs.
>
> The problem was that aer_recover_queue() queues the pointer directly
> without copying the aer_capability_regs data.  The pointer was to
> the ghes->estatus buffer, which could be reused before
> aer_recover_work_func() reads the data.
>
> To avoid this problem, allocate a new aer_capability_regs structure
> from the ghes_estatus_pool, copy the AER data from the ghes->estatus
> buffer into it, pass a pointer to the new struct to
> aer_recover_queue(), and free it after aer_recover_work_func() has
> processed it.
>
> Reported-by: Bjorn Helgaas <helgaas@kernel.org>
> Acked-by: Bjorn Helgaas <bhelgaas@google.com>
> Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
> ---
> Changes from v1 to v2:
> 1. Updated patch description with the description Bjorn has suggested.
> 2. Add Acked-by: Bjorn Helgaas <bhelgaas@google.com>.
> ---
>  drivers/acpi/apei/ghes.c | 23 ++++++++++++++++++++++-
>  drivers/pci/pcie/aer.c   | 10 ++++++++++
>  include/acpi/ghes.h      |  1 +
>  3 files changed, 33 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
> index ef59d6ea16da..63ad0541db38 100644
> --- a/drivers/acpi/apei/ghes.c
> +++ b/drivers/acpi/apei/ghes.c
> @@ -209,6 +209,20 @@ int ghes_estatus_pool_init(unsigned int num_ghes)
>         return -ENOMEM;
>  }
>
> +/**
> + * ghes_estatus_pool_region_free - free previously allocated memory
> + *                                from the ghes_estatus_pool.
> + * @addr: address of memory to free.
> + * @size: size of memory to free.
> + *
> + * Returns none.
> + */
> +void ghes_estatus_pool_region_free(unsigned long addr, u32 size)
> +{
> +       gen_pool_free(ghes_estatus_pool, addr, size);
> +}
> +EXPORT_SYMBOL_GPL(ghes_estatus_pool_region_free);
> +
>  static int map_gen_v2(struct ghes *ghes)
>  {
>         return apei_map_generic_address(&ghes->generic_v2->read_ack_register);
> @@ -564,6 +578,7 @@ static void ghes_handle_aer(struct acpi_hest_generic_data *gdata)
>             pcie_err->validation_bits & CPER_PCIE_VALID_AER_INFO) {
>                 unsigned int devfn;
>                 int aer_severity;
> +               u8 *aer_info;
>
>                 devfn = PCI_DEVFN(pcie_err->device_id.device,
>                                   pcie_err->device_id.function);
> @@ -577,11 +592,17 @@ static void ghes_handle_aer(struct acpi_hest_generic_data *gdata)
>                 if (gdata->flags & CPER_SEC_RESET)
>                         aer_severity = AER_FATAL;
>
> +               aer_info = (void *)gen_pool_alloc(ghes_estatus_pool,
> +                                                 sizeof(struct aer_capability_regs));
> +               if (!aer_info)
> +                       return;
> +               memcpy(aer_info, pcie_err->aer_info, sizeof(struct aer_capability_regs));
> +
>                 aer_recover_queue(pcie_err->device_id.segment,
>                                   pcie_err->device_id.bus,
>                                   devfn, aer_severity,
>                                   (struct aer_capability_regs *)
> -                                 pcie_err->aer_info);
> +                                 aer_info);
>         }
>  #endif
>  }
> diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c
> index e85ff946e8c8..388b614c11fd 100644
> --- a/drivers/pci/pcie/aer.c
> +++ b/drivers/pci/pcie/aer.c
> @@ -29,6 +29,7 @@
>  #include <linux/kfifo.h>
>  #include <linux/slab.h>
>  #include <acpi/apei.h>
> +#include <acpi/ghes.h>
>  #include <ras/ras_event.h>
>
>  #include "../pci.h"
> @@ -996,6 +997,15 @@ static void aer_recover_work_func(struct work_struct *work)
>                         continue;
>                 }
>                 cper_print_aer(pdev, entry.severity, entry.regs);
> +               /*
> +                * Memory for aer_capability_regs(entry.regs) is being allocated from the
> +                * ghes_estatus_pool to protect it from overwriting when multiple sections
> +                * are present in the error status. Thus free the same after processing
> +                * the data.
> +                */
> +               ghes_estatus_pool_region_free((unsigned long)entry.regs,
> +                                             sizeof(struct aer_capability_regs));
> +
>                 if (entry.severity == AER_NONFATAL)
>                         pcie_do_recovery(pdev, pci_channel_io_normal,
>                                          aer_root_reset);
> diff --git a/include/acpi/ghes.h b/include/acpi/ghes.h
> index 3c8bba9f1114..40d89e161076 100644
> --- a/include/acpi/ghes.h
> +++ b/include/acpi/ghes.h
> @@ -78,6 +78,7 @@ static inline struct list_head *ghes_get_devices(void) { return NULL; }
>  #endif
>
>  int ghes_estatus_pool_init(unsigned int num_ghes);
> +void ghes_estatus_pool_region_free(unsigned long addr, u32 size);

If I'm not mistaken, this needs to go under #ifdef
CONFIG_ACPI_APEI_GHES and it needs an empty stub for the case when
CONFIG_ACPI_APEI_GHES is not set.

>
>  static inline int acpi_hest_get_version(struct acpi_hest_generic_data *gdata)
>  {
> --
> 2.34.1
>

RE: [PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when error status data has multiple sections

[Shiju Jose]

Hi Rafael,

>-----Original Message-----
>From: Rafael J. Wysocki <rafael@kernel.org>
>Sent: 20 September 2023 18:23
>To: Shiju Jose <shiju.jose@huawei.com>
>Cc: helgaas@kernel.org; rafael@kernel.org; lenb@kernel.org;
>tony.luck@intel.com; james.morse@arm.com; bp@alien8.de;
>ying.huang@intel.com; linux-acpi@vger.kernel.org; linux-pci@vger.kernel.org;
>linux-kernel@vger.kernel.org; Linuxarm <linuxarm@huawei.com>; Jonathan
>Cameron <jonathan.cameron@huawei.com>; tanxiaofei
><tanxiaofei@huawei.com>; Zengtao (B) <prime.zeng@hisilicon.com>
>Subject: Re: [PATCH v2 1/1] ACPI / APEI: Fix for overwriting AER info when error
>status data has multiple sections
>
>On Tue, Sep 19, 2023 at 11:16 AM <shiju.jose@huawei.com> wrote:
>>
>> From: Shiju Jose <shiju.jose@huawei.com>
>>
>> ghes_handle_aer() passes AER data to the PCI core for logging and
>> recovery by calling aer_recover_queue() with a pointer to struct
>> aer_capability_regs.
>>
>> The problem was that aer_recover_queue() queues the pointer directly
>> without copying the aer_capability_regs data.  The pointer was to the
>> ghes->estatus buffer, which could be reused before
>> aer_recover_work_func() reads the data.
>>
>> To avoid this problem, allocate a new aer_capability_regs structure
>> from the ghes_estatus_pool, copy the AER data from the ghes->estatus
>> buffer into it, pass a pointer to the new struct to
>> aer_recover_queue(), and free it after aer_recover_work_func() has
>> processed it.
>>
>> Reported-by: Bjorn Helgaas <helgaas@kernel.org>
>> Acked-by: Bjorn Helgaas <bhelgaas@google.com>
>> Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
>> ---
>> Changes from v1 to v2:
>> 1. Updated patch description with the description Bjorn has suggested.
>> 2. Add Acked-by: Bjorn Helgaas <bhelgaas@google.com>.
>> ---
>>  drivers/acpi/apei/ghes.c | 23 ++++++++++++++++++++++-
>>  drivers/pci/pcie/aer.c   | 10 ++++++++++
>>  include/acpi/ghes.h      |  1 +
>>  3 files changed, 33 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index
>> ef59d6ea16da..63ad0541db38 100644
>> --- a/drivers/acpi/apei/ghes.c
>> +++ b/drivers/acpi/apei/ghes.c
>> @@ -209,6 +209,20 @@ int ghes_estatus_pool_init(unsigned int num_ghes)
>>         return -ENOMEM;
>>  }
>>
>> +/**
>> + * ghes_estatus_pool_region_free - free previously allocated memory
>> + *                                from the ghes_estatus_pool.
>> + * @addr: address of memory to free.
>> + * @size: size of memory to free.
>> + *
>> + * Returns none.
>> + */
>> +void ghes_estatus_pool_region_free(unsigned long addr, u32 size) {
>> +       gen_pool_free(ghes_estatus_pool, addr, size); }
>> +EXPORT_SYMBOL_GPL(ghes_estatus_pool_region_free);
>> +
>>  static int map_gen_v2(struct ghes *ghes)  {
>>         return
>> apei_map_generic_address(&ghes->generic_v2->read_ack_register);
>> @@ -564,6 +578,7 @@ static void ghes_handle_aer(struct
>acpi_hest_generic_data *gdata)
>>             pcie_err->validation_bits & CPER_PCIE_VALID_AER_INFO) {
>>                 unsigned int devfn;
>>                 int aer_severity;
>> +               u8 *aer_info;
>>
>>                 devfn = PCI_DEVFN(pcie_err->device_id.device,
>>                                   pcie_err->device_id.function); @@
>> -577,11 +592,17 @@ static void ghes_handle_aer(struct
>acpi_hest_generic_data *gdata)
>>                 if (gdata->flags & CPER_SEC_RESET)
>>                         aer_severity = AER_FATAL;
>>
>> +               aer_info = (void *)gen_pool_alloc(ghes_estatus_pool,
>> +                                                 sizeof(struct aer_capability_regs));
>> +               if (!aer_info)
>> +                       return;
>> +               memcpy(aer_info, pcie_err->aer_info, sizeof(struct
>> + aer_capability_regs));
>> +
>>                 aer_recover_queue(pcie_err->device_id.segment,
>>                                   pcie_err->device_id.bus,
>>                                   devfn, aer_severity,
>>                                   (struct aer_capability_regs *)
>> -                                 pcie_err->aer_info);
>> +                                 aer_info);
>>         }
>>  #endif
>>  }
>> diff --git a/drivers/pci/pcie/aer.c b/drivers/pci/pcie/aer.c index
>> e85ff946e8c8..388b614c11fd 100644
>> --- a/drivers/pci/pcie/aer.c
>> +++ b/drivers/pci/pcie/aer.c
>> @@ -29,6 +29,7 @@
>>  #include <linux/kfifo.h>
>>  #include <linux/slab.h>
>>  #include <acpi/apei.h>
>> +#include <acpi/ghes.h>
>>  #include <ras/ras_event.h>
>>
>>  #include "../pci.h"
>> @@ -996,6 +997,15 @@ static void aer_recover_work_func(struct work_struct
>*work)
>>                         continue;
>>                 }
>>                 cper_print_aer(pdev, entry.severity, entry.regs);
>> +               /*
>> +                * Memory for aer_capability_regs(entry.regs) is being allocated
>from the
>> +                * ghes_estatus_pool to protect it from overwriting when multiple
>sections
>> +                * are present in the error status. Thus free the same after
>processing
>> +                * the data.
>> +                */
>> +               ghes_estatus_pool_region_free((unsigned long)entry.regs,
>> +                                             sizeof(struct
>> + aer_capability_regs));
>> +
>>                 if (entry.severity == AER_NONFATAL)
>>                         pcie_do_recovery(pdev, pci_channel_io_normal,
>>                                          aer_root_reset); diff --git
>> a/include/acpi/ghes.h b/include/acpi/ghes.h index
>> 3c8bba9f1114..40d89e161076 100644
>> --- a/include/acpi/ghes.h
>> +++ b/include/acpi/ghes.h
>> @@ -78,6 +78,7 @@ static inline struct list_head
>> *ghes_get_devices(void) { return NULL; }  #endif
>>
>>  int ghes_estatus_pool_init(unsigned int num_ghes);
>> +void ghes_estatus_pool_region_free(unsigned long addr, u32 size);
>
>If I'm not mistaken, this needs to go under #ifdef CONFIG_ACPI_APEI_GHES and
>it needs an empty stub for the case when CONFIG_ACPI_APEI_GHES is not set.

Thanks. You are right. It was fixed and is under build check for i386 and aarch64, 
testing etc.
I will post the updated patch soon. 
>
>>
>>  static inline int acpi_hest_get_version(struct acpi_hest_generic_data
>> *gdata)  {
>> --
>> 2.34.1
>>
Thanks,
Shiju