[PATCH 0/3] two small fixes out of kernel/sys.c

[PATCH 0/3] two small fixes out of kernel/sys.c

[Bradley Morgan]

Two unrelated things that came out of reading kernel/sys.c line by line.
They are in one series only because they came from the same read, patch 3
stands on its own and can be taken without the other two.

Patches 1 and 2 have to go in that order.  PR_FUTEX_HASH is the only case
in the prctl switch that does not check the args it does not use, arg5
does not even reach futex_hash_prctl().  Patch 2 adds the checks.  Patch 1
goes first because prctl() is variadic, so the two callers under tools/
leave the args they do not pass as whatever those registers hold, and
patch 2 would fail them at random without it.

Patch 3 is compat_sysinfo().  It scales the 64 bit memory values down so
they fit the 32 bit fields, and stops when the unit reaches PAGE_SIZE.
But do_sysinfo() hands it bytes with mem_unit at 1, so on a box with
enough ram it stops far too early and drops the high bits.  16 TiB reads
back as 0 and 17 TiB reads back as 1 TiB.  The loop only runs longer on
the path that was already wrong, nothing that works today changes.

Tested on ppc64.

Bradley Morgan (3):
  tools: pass the unused prctl() args explicitly for PR_FUTEX_HASH
  futex: reject the unused PR_FUTEX_HASH arguments
  compat: make compat_sysinfo() scale far enough to actually fit

 include/linux/futex.h                         |  6 ++--
 kernel/futex/core.c                           |  7 +++--
 kernel/sys.c                                  | 28 +++++++++----------
 tools/perf/bench/futex.c                      |  4 +--
 .../futex/functional/futex_priv_hash.c        |  4 +--
 5 files changed, 26 insertions(+), 23 deletions(-)

-- 
2.53.0

[PATCH 1/3] tools: pass the unused prctl() args explicitly for PR_FUTEX_HASH

[Bradley Morgan]

prctl() is declared variadic in sys/prctl.h, so an argument the caller
leaves out of the call is whatever that register happens to hold.
Neither file passes all five.  The two SET_SLOTS calls leave arg5 out
and the two GET_SLOTS calls leave arg3, arg4 and arg5 out, so those are
whatever the registers hold.  The kernel does not look at them today so
it works, but it works by luck.  I checked that against a running
kernel, garbage in arg5 on SET_SLOTS and in all three on GET_SLOTS are
accepted.

Pass the zeros.  No functional change.

Signed-off-by: Bradley Morgan <brads@mainlining.org>
---
 tools/perf/bench/futex.c                                   | 4 ++--
 tools/testing/selftests/futex/functional/futex_priv_hash.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/perf/bench/futex.c b/tools/perf/bench/futex.c
index 1968c9d00b5bb..f4c1c30efe0bd 100644
--- a/tools/perf/bench/futex.c
+++ b/tools/perf/bench/futex.c
@@ -20,7 +20,7 @@ void futex_set_nbuckets_param(struct bench_futex_parameters *params)
 	if (params->nbuckets < 0)
 		return;
 
-	ret = prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS, params->nbuckets, 0);
+	ret = prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS, params->nbuckets, 0, 0);
 	if (ret) {
 		printf("Requesting %d hash buckets failed: %d/%m\n",
 		       params->nbuckets, ret);
@@ -33,7 +33,7 @@ void futex_print_nbuckets(struct bench_futex_parameters *params)
 	char *futex_hash_mode;
 	int ret;
 
-	ret = prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_GET_SLOTS);
+	ret = prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_GET_SLOTS, 0, 0, 0);
 	if (params->nbuckets >= 0) {
 		if (ret != params->nbuckets) {
 			if (ret < 0) {
diff --git a/tools/testing/selftests/futex/functional/futex_priv_hash.c b/tools/testing/selftests/futex/functional/futex_priv_hash.c
index a8742e2045402..96bfb72362221 100644
--- a/tools/testing/selftests/futex/functional/futex_priv_hash.c
+++ b/tools/testing/selftests/futex/functional/futex_priv_hash.c
@@ -32,12 +32,12 @@ static int counter;
 
 static int futex_hash_slots_set(unsigned int slots)
 {
-	return prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS, slots, 0);
+	return prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS, slots, 0, 0);
 }
 
 static int futex_hash_slots_get(void)
 {
-	return prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_GET_SLOTS);
+	return prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_GET_SLOTS, 0, 0, 0);
 }
 
 static void futex_hash_slots_set_verify(struct __test_metadata *_metadata, int slots)
-- 
2.53.0

Re: [PATCH 1/3] tools: pass the unused prctl() args explicitly for PR_FUTEX_HASH

[sashiko-bot]

> prctl() is declared variadic in sys/prctl.h, so an argument the caller
> leaves out of the call is whatever that register happens to hold.
> Neither file passes all five.  The two SET_SLOTS calls leave arg5 out
> and the two GET_SLOTS calls leave arg3, arg4 and arg5 out, so those are
> whatever the registers hold.  The kernel does not look at them today so
> it works, but it works by luck.  I checked that against a running
> kernel, garbage in arg5 on SET_SLOTS and in all three on GET_SLOTS are
> accepted.
> 
> Pass the zeros.  No functional change.
> 
> Signed-off-by: Bradley Morgan <brads@mainlining.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105003129.3130709-2-brads@mainlining.org?part=1