Re: 6.1rc1: NFS memcpy warning on mount

Re: 6.1rc1: NFS memcpy warning on mount

[Bagas Sanjaya]

[-- Attachment #1: Type: text/plain, Size: 3801 bytes --]

On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
> Started getting this during mount on a 6.1rc1 kernel..
> not sure which mount it's complaining about, but they're all v3 tcp
> mounts on that machine.
> 
> [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)
> [   19.617504] WARNING: CPU: 3 PID: 1300 at fs/nfs/super.c:857 nfs_request_mount.constprop.0.isra.0+0x1c0/0x1f0
> [   19.617528] CPU: 3 PID: 1300 Comm: mount.nfs Not tainted 6.1.0-rc1-backup+ #1
> [   19.617553] RIP: 0010:nfs_request_mount.constprop.0.isra.0+0x1c0/0x1f0
> [   19.617566] Code: 16 81 01 00 75 9b 48 c7 c1 ff ff ff ff 48 c7 c2 a8 a8 82 ab 4c 89 e6 c6 05 36 16 81 01 01 48 c7 c7 a8 3a 81 ab e8 61 1d 9a 00 <0f> 0b 48 8b 3c 24 e9 6c ff ff ff c7 83 20 01 00 00 01 00 00 00 b8
> [   19.617593] RSP: 0018:ffffc900027fbd48 EFLAGS: 00010286
> [   19.617604] RAX: 0000000000000000 RBX: ffff8881208d5000 RCX: ffff88842fadb7a8
> [   19.617617] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff88842fadb7a0
> [   19.617629] RBP: ffff8881208d5130 R08: 0000000000000000 R09: ffffffffaba5c540
> [   19.617641] R10: 0000000000000001 R11: 0000000000000001 R12: 000000000000001c
> [   19.617653] R13: 0000000000000001 R14: ffffc900027fbef0 R15: ffff888100b3bea0
> [   19.617665] FS:  00007ff793dd6840(0000) GS:ffff88842fac0000(0000) knlGS:0000000000000000
> [   19.617679] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   19.617690] CR2: 0000564a1a747468 CR3: 00000001106fb003 CR4: 00000000001706e0
> [   19.617703] Call Trace:
> [   19.617709]  <TASK>
> [   19.617716]  nfs_try_get_tree+0xa1/0x220
> [   19.617725]  ? get_nfs_version+0x63/0x130
> [   19.617736]  vfs_get_tree+0x1d/0x90
> [   19.617746]  ? capable+0x2f/0x50
> [   19.617755]  path_mount+0x75c/0xb00
> [   19.617766]  __x64_sys_mount+0x19a/0x200
> [   19.617775]  do_syscall_64+0x35/0x80
> [   19.617785]  entry_SYSCALL_64_after_hwframe+0x46/0xb0
> [   19.617796] RIP: 0033:0x7ff7941ac6ea
> [   19.617805] Code: 48 8b 0d a9 17 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 17 0d 00 f7 d8 64 89 01 48
> [   19.617832] RSP: 002b:00007ffd02ae4ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
> [   19.617846] RAX: ffffffffffffffda RBX: 00007ffd02ae4e70 RCX: 00007ff7941ac6ea
> [   19.617858] RDX: 0000564a1a73fb60 RSI: 0000564a1a73fb80 RDI: 0000564a1a741890
> [   19.617870] RBP: 00007ff793dd67b8 R08: 0000564a1a73f480 R09: 0000564a1a73f480
> [   19.617882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> [   19.617894] R13: 00007ffd02ae4dd0 R14: 0000564a1a7474e0 R15: 0000564a1a7436b0
> [   19.617907]  </TASK>
> [   19.617913] irq event stamp: 8757
> [   19.617920] hardirqs last  enabled at (8769): [<ffffffffaa1397c2>] __up_console_sem+0x52/0x60
> [   19.617937] hardirqs last disabled at (8780): [<ffffffffaa1397a7>] __up_console_sem+0x37/0x60
> [   19.617952] softirqs last  enabled at (8180): [<ffffffffaabf547a>] sk_common_release+0x5a/0xe0
> [   19.617969] softirqs last disabled at (8178): [<ffffffffaabf5456>] sk_common_release+0x36/0xe0
> [   19.617984] ---[ end trace 0000000000000000 ]---
> 

Hmm, the blamed line in the warning is introduced by 38465f5d1af932 ("NFS:
rename nfs_fs_context pointer arg in a few functions"). Cc: the commit
author. Also Cc: Kees for authoring the patch [1] that have fixed
similar warning.

Also, does v6.0 have this warning? If so, you need to bisect in the range
of v6.0..v6.1-rc1.

Thanks.

[1]: https://lore.kernel.org/lkml/20221011065243.583650-1-keescook@chromium.org/

-- 
An old man doll... just what I always wanted! - Clara

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: 6.1rc1: NFS memcpy warning on mount

[Kees Cook]

On Mon, Oct 17, 2022 at 10:58:55AM +0700, Bagas Sanjaya wrote:
> On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
> > Started getting this during mount on a 6.1rc1 kernel..
> > not sure which mount it's complaining about, but they're all v3 tcp
> > mounts on that machine.
> > 
> > [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)
> [...]
> Hmm, the blamed line in the warning is introduced by 38465f5d1af932 ("NFS:
> rename nfs_fs_context pointer arg in a few functions"). Cc: the commit
> author. Also Cc: Kees for authoring the patch [1] that have fixed
> similar warning.

The warning is from commit 54d9469bc515 ("fortify: Add run-time WARN
for cross-field memcpy()")

> Also, does v6.0 have this warning? If so, you need to bisect in the range
> of v6.0..v6.1-rc1.

No need for bisection -- this is almost certainly a false positive (as
detailed in the above commit: we're working on purging all of these
cases from the kernel).

> [1]: https://lore.kernel.org/lkml/20221011065243.583650-1-keescook@chromium.org/

Yeah, I have a v2 of this patch, which should also fix this request.sap
issue. Sending shortly...

-- 
Kees Cook

Re: 6.1rc1: NFS memcpy warning on mount

[Bagas Sanjaya]

On 10/17/22 11:17, Kees Cook wrote:
> On Mon, Oct 17, 2022 at 10:58:55AM +0700, Bagas Sanjaya wrote:
>> On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
>>> Started getting this during mount on a 6.1rc1 kernel..
>>> not sure which mount it's complaining about, but they're all v3 tcp
>>> mounts on that machine.
>>>
>>> [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)
>> [...]
>> Hmm, the blamed line in the warning is introduced by 38465f5d1af932 ("NFS:
>> rename nfs_fs_context pointer arg in a few functions"). Cc: the commit
>> author. Also Cc: Kees for authoring the patch [1] that have fixed
>> similar warning.
> 
> The warning is from commit 54d9469bc515 ("fortify: Add run-time WARN
> for cross-field memcpy()")
> 
>> Also, does v6.0 have this warning? If so, you need to bisect in the range
>> of v6.0..v6.1-rc1.
> 
> No need for bisection -- this is almost certainly a false positive (as
> detailed in the above commit: we're working on purging all of these
> cases from the kernel).
> 
>> [1]: https://lore.kernel.org/lkml/20221011065243.583650-1-keescook@chromium.org/
> 
> Yeah, I have a v2 of this patch, which should also fix this request.sap
> issue. Sending shortly...
> 

OK, thanks!

-- 
An old man doll... just what I always wanted! - Clara