From: Joe Perches <joe@perches.com>
To: Martin Schwidefsky <schwidefsky@de.ibm.com>,
Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: linux-s390@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
Rasmus Villemoes <linux@rasmusvillemoes.dk>,
Petr Mladek <pmladek@suse.com>
Subject: s390: defective uses of va_arg in __debug_sprintf_event
Date: Fri, 06 Apr 2018 12:08:43 -0700 [thread overview]
Message-ID: <1523041723.6127.33.camel@perches.com> (raw)
debug_sprintf_event calls __debug_sprintf_event
with a format and arguments.
There various types of arguments used in these
call, but __debug_sprintf_event uses va_arg
with only long as the type argument so random
errors could occur because the type and argument
are supposed to match.
debug_entry_t *__debug_sprintf_event(debug_info_t *id, int level, char *string, ...)
{
[...]
va_start(ap, string);
curr_event->string = string;
for (idx = 0; idx < min(numargs, (int)(id->buf_size / sizeof(long)) - 1); idx++)
curr_event->args[idx] = va_arg(ap, long);
va_end(ap);
[...]
}
from man va_arg
va_arg()
if type is not compatible with the type of the actual next argument
(as promoted according to the default argument promotions),
random errors will occur.
For instance, uses like:
arch/s390/kernel/perf_cpum_sf.c:919: debug_sprintf_event(sfdbg, 6, "pmu_enable: es=%i cs=%i ed=%i cd=%i "
arch/s390/kernel/perf_cpum_sf.c-920- "tear=%p dear=%p\n", cpuhw->lsctl.es, cpuhw->lsctl.cs,
arch/s390/kernel/perf_cpum_sf.c-921- cpuhw->lsctl.ed, cpuhw->lsctl.cd,
arch/s390/kernel/perf_cpum_sf.c-922- (void *) cpuhw->lsctl.tear, (void *) cpuhw->lsctl.dear);
where the first 3 arguments are int but their type
as used by va_arg in __debug_sprintf_event is long
which could produce random errors.
Instead of adding complete format % decoding,
perhaps the easiest solution is to change all
the formats to use %lu or %ld and cast each
argument as appropriate.
And I found this when looking at another defect
in debug_sprintf_event where a %p<foo> extension
is unintentionally used via a string concatenation.
as pointed out by Rasmus Villemoes
---
arch/s390/kernel/perf_cpum_sf.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
index 1c9ddd7aa5ec..1c449a6f841a 100644
--- a/arch/s390/kernel/perf_cpum_sf.c
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -212,9 +212,7 @@ static int realloc_sampling_buffer(struct sf_buffer *sfb,
* the sampling buffer origin.
*/
if (sfb->sdbt != get_next_sdbt(tail)) {
- debug_sprintf_event(sfdbg, 3, "realloc_sampling_buffer: "
- "sampling buffer is not linked: origin=%p"
- "tail=%p\n",
+ debug_sprintf_event(sfdbg, 3, "realloc_sampling_buffer: sampling buffer is not linked: origin=%p tail=%p\n",
(void *) sfb->sdbt, (void *) tail);
return -EINVAL;
}
next reply other threads:[~2018-04-06 19:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-06 19:08 Joe Perches [this message]
2018-04-09 12:39 ` s390: defective uses of va_arg in __debug_sprintf_event Martin Schwidefsky
2018-04-09 14:38 ` Joe Perches
2018-04-10 14:35 ` Petr Mladek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1523041723.6127.33.camel@perches.com \
--to=joe@perches.com \
--cc=heiko.carstens@de.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=pmladek@suse.com \
--cc=schwidefsky@de.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox