Re: [PATCH v3 05/26] genirq/irqdesc: Annotate static information into meminspect

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Missing explicit alignment in `MEMINSPECT_ENTRY` causes compiler-injected padding in the `.inspect_table` section, breaking array iteration and leading to a boot-time out-of-bounds write.
--

--- Patch [5]: [PATCH v3 05/26] genirq/irqdesc: Annotate static information into meminspect ---
commit 457b76345a308caf0fe6e0e39b0d770189713dab
Author: Eugen Hristev <ehristev@kernel.org>

genirq/irqdesc: Annotate static information into meminspect

Annotate vital static information into inspection table:
 - total_nr_irqs

Information on these annotated variables is stored in a dedicated
meminspect section.

> diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
> index 80ef4e27dcf47..4e58e7f5fc6ce 100644
> --- a/kernel/irq/irqdesc.c
> +++ b/kernel/irq/irqdesc.c

[ ... ]

> @@ -142,6 +143,7 @@ static void desc_set_defaults(unsigned int irq, struct irq_desc *desc, int node,
>  }
>  
>  unsigned int total_nr_irqs __read_mostly = NR_IRQS;
> +MEMINSPECT_SIMPLE_ENTRY(total_nr_irqs);

[Severity: Critical]
Does adding this meminspect entry risk a boot-time out-of-bounds write
due to missing alignment constraints in the underlying macro?

Looking at MEMINSPECT_ENTRY() in include/linux/meminspect.h, instances
of struct inspect_entry are placed into the .inspect_table linker section
without an explicit alignment constraint:

include/linux/meminspect.h:MEMINSPECT_ENTRY() {
    static const struct inspect_entry __UNIQUE_ID(...) \
    __used __section(".inspect_table") = {
        .id = idx,
        .va = (void *)&(sym),
        .size = (sz),
    }
}

On 64-bit systems where sizeof(struct inspect_entry) is 40 bytes, the
compiler can over-align static variables, inserting padding between
adjacent entries in the section.

When meminspect_prepare_table() iterates over the section using pointer
arithmetic, the pointer advances by exactly 40 bytes. If padding is
present, it will fall out of sync, read garbage values into e->id, and
cause an unbounded array index write:

kernel/meminspect/meminspect.c:meminspect_prepare_table() {
    for_each_meminspect_entry(e) {
        inspect_entries[e->id] = *e;
        if (!inspect_entries[e->id].pa && inspect_entries[e->id].va)
            ...
}

Could the macro definition be updated to include an alignment attribute
like __aligned(__alignof__(struct inspect_entry)) to prevent the compiler
from inserting this padding?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260708-meminspect-v3-v3-0-7aa5a0a74d5c@oss.qualcomm.com?part=5