public inbox for linux-s390@vger.kernel.org
 help / color / mirror / Atom feed
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
To: Joe Perches <joe@perches.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>,
	linux-s390@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
	Rasmus Villemoes <linux@rasmusvillemoes.dk>,
	Petr Mladek <pmladek@suse.com>
Subject: Re: s390: defective uses of va_arg in __debug_sprintf_event
Date: Mon, 9 Apr 2018 14:39:34 +0200	[thread overview]
Message-ID: <20180409143934.3f27902c@mschwideX1> (raw)
In-Reply-To: <1523041723.6127.33.camel@perches.com>

On Fri, 06 Apr 2018 12:08:43 -0700
Joe Perches <joe@perches.com> wrote:

> debug_sprintf_event calls __debug_sprintf_event
> with a format and arguments.
> 
> There various types of arguments used in these
> call, but __debug_sprintf_event uses va_arg
> with only long as the type argument so random
> errors could occur because the type and argument
> are supposed to match.
> 
>     debug_entry_t *__debug_sprintf_event(debug_info_t *id, int level, char *string, ...)
>     {
>     	    [...]
>     	    va_start(ap, string);
>     	    curr_event->string = string;
>     	    for (idx = 0; idx < min(numargs, (int)(id->buf_size / sizeof(long)) - 1); idx++)
>     	    	    curr_event->args[idx] = va_arg(ap, long);
>     	    va_end(ap);
>     	    [...]
>     }
> 
> from man va_arg
> 
>     va_arg()
> 
>     if type is not compatible with the type of the actual next argument
>     (as promoted according to the default argument promotions),
>     random errors will occur.
> 
> For instance, uses like:
> 
> arch/s390/kernel/perf_cpum_sf.c:919:    debug_sprintf_event(sfdbg, 6, "pmu_enable: es=%i cs=%i ed=%i cd=%i "
> arch/s390/kernel/perf_cpum_sf.c-920-                        "tear=%p dear=%p\n", cpuhw->lsctl.es, cpuhw->lsctl.cs,
> arch/s390/kernel/perf_cpum_sf.c-921-                        cpuhw->lsctl.ed, cpuhw->lsctl.cd,
> arch/s390/kernel/perf_cpum_sf.c-922-                        (void *) cpuhw->lsctl.tear, (void *) cpuhw->lsctl.dear);
> 
> where the first 3 arguments are int but their type
> as used by va_arg in __debug_sprintf_event is long
> which could produce random errors.

In principle you are right that the va_arg handling is not 100%
correct. It works though because the C ABI for s390x requires
that arguments are sign- or zero-extended to 64 bits by the caller
of a function. This is true for values passed in registers and for
the variable argument list.

-- 
blue skies,
   Martin.

"Reality continues to ruin my life." - Calvin.

  reply	other threads:[~2018-04-09 12:39 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-06 19:08 s390: defective uses of va_arg in __debug_sprintf_event Joe Perches
2018-04-09 12:39 ` Martin Schwidefsky [this message]
2018-04-09 14:38   ` Joe Perches
2018-04-10 14:35 ` Petr Mladek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180409143934.3f27902c@mschwideX1 \
    --to=schwidefsky@de.ibm.com \
    --cc=heiko.carstens@de.ibm.com \
    --cc=joe@perches.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-s390@vger.kernel.org \
    --cc=linux@rasmusvillemoes.dk \
    --cc=pmladek@suse.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox