Re: [PATCH] powerpc/signal32: Use struct_group() to zero spe regs

[LEROY Christophe <christophe.leroy@csgroup.eu>]

Le 18/11/2021 à 21:36, Kees Cook a écrit :
> In preparation for FORTIFY_SOURCE performing compile-time and run-time
> field bounds checking for memset(), avoid intentionally writing across
> neighboring fields.
> 
> Add a struct_group() for the spe registers so that memset() can correctly reason
> about the size:
> 
>     In function 'fortify_memset_chk',
>         inlined from 'restore_user_regs.part.0' at arch/powerpc/kernel/signal_32.c:539:3:
>     >> include/linux/fortify-string.h:195:4: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
>       195 |    __write_overflow_field();
>           |    ^~~~~~~~~~~~~~~~~~~~~~~~
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>

Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu>

However, is it really worth adding that grouping ? Wouldn't it be 
cleaner to handle evr[] and acc separately ? Now that we are using 
unsafe variants of get/put user performance wouldn't be impacted.

I have some doubts about things like:

	unsafe_copy_to_user(&frame->mc_vregs, current->thread.evr,
				    ELF_NEVRREG * sizeof(u32), failed);

Because as far as I can see, ELF_NEVRREG is 34 but mc_vregs is a table 
of 33 u32 and is at the end of the structure:

	struct mcontext {
		elf_gregset_t	mc_gregs;
		elf_fpregset_t	mc_fregs;
		unsigned long	mc_pad[2];
		elf_vrregset_t	mc_vregs __attribute__((__aligned__(16)));
	};

	typedef elf_vrreg_t elf_vrregset_t[ELF_NVRREG];

	# define ELF_NEVRREG	34	/* includes acc (as 2) */
	# define ELF_NVRREG	33	/* includes vscr */



> ---
>   arch/powerpc/include/asm/processor.h |  6 ++++--
>   arch/powerpc/kernel/signal_32.c      | 14 +++++++++-----
>   2 files changed, 13 insertions(+), 7 deletions(-)
> 
> diff --git a/arch/powerpc/include/asm/processor.h b/arch/powerpc/include/asm/processor.h
> index e39bd0ff69f3..978a80308466 100644
> --- a/arch/powerpc/include/asm/processor.h
> +++ b/arch/powerpc/include/asm/processor.h
> @@ -191,8 +191,10 @@ struct thread_struct {
>   	int		used_vsr;	/* set if process has used VSX */
>   #endif /* CONFIG_VSX */
>   #ifdef CONFIG_SPE
> -	unsigned long	evr[32];	/* upper 32-bits of SPE regs */
> -	u64		acc;		/* Accumulator */
> +	struct_group(spe,
> +		unsigned long	evr[32];	/* upper 32-bits of SPE regs */
> +		u64		acc;		/* Accumulator */
> +	);
>   	unsigned long	spefscr;	/* SPE & eFP status */
>   	unsigned long	spefscr_last;	/* SPEFSCR value on last prctl
>   					   call or trap return */
> diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
> index 00a9c9cd6d42..5e1664b501e4 100644
> --- a/arch/powerpc/kernel/signal_32.c
> +++ b/arch/powerpc/kernel/signal_32.c
> @@ -527,16 +527,20 @@ static long restore_user_regs(struct pt_regs *regs,
>   	regs_set_return_msr(regs, regs->msr & ~(MSR_FP | MSR_FE0 | MSR_FE1));
>   
>   #ifdef CONFIG_SPE
> -	/* force the process to reload the spe registers from
> -	   current->thread when it next does spe instructions */
> +	/*
> +	 * Force the process to reload the spe registers from
> +	 * current->thread when it next does spe instructions.
> +	 * Since this is user ABI, we must enforce the sizing.
> +	 */
> +	BUILD_BUG_ON(sizeof(current->thread.spe) != ELF_NEVRREG * sizeof(u32));
>   	regs_set_return_msr(regs, regs->msr & ~MSR_SPE);
>   	if (msr & MSR_SPE) {
>   		/* restore spe registers from the stack */
> -		unsafe_copy_from_user(current->thread.evr, &sr->mc_vregs,
> -				      ELF_NEVRREG * sizeof(u32), failed);
> +		unsafe_copy_from_user(&current->thread.spe, &sr->mc_vregs,
> +				      sizeof(current->thread.spe), failed);
>   		current->thread.used_spe = true;
>   	} else if (current->thread.used_spe)
> -		memset(current->thread.evr, 0, ELF_NEVRREG * sizeof(u32));
> +		memset(&current->thread.spe, 0, sizeof(current->thread.spe));
>   
>   	/* Always get SPEFSCR back */
>   	unsafe_get_user(current->thread.spefscr, (u32 __user *)&sr->mc_vregs + ELF_NEVRREG, failed);
>