From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BBA6ECD1284 for ; Tue, 9 Apr 2024 08:54:34 +0000 (UTC) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=ellerman.id.au header.i=@ellerman.id.au header.a=rsa-sha256 header.s=201909 header.b=lNpmlzQL; dkim-atps=neutral Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4VDKX92yCkz3vX2 for ; Tue, 9 Apr 2024 18:54:33 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ellerman.id.au header.i=@ellerman.id.au header.a=rsa-sha256 header.s=201909 header.b=lNpmlzQL; dkim-atps=neutral Received: from gandalf.ozlabs.org (mail.ozlabs.org [IPv6:2404:9400:2221:ea00::3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4VDKWN4mVxz30fh for ; Tue, 9 Apr 2024 18:53:52 +1000 (AEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ellerman.id.au; s=201909; t=1712652832; bh=n2NkYD5ALou1bAVVYZN89InnCEaR3zlmB6pBb07YURQ=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From; b=lNpmlzQLgZX0M9iUrm9UJakKOmEtuKy8gfUWUs8AzJtJJGAnXOiST9+cKxwy2kKJi SdtNzoXJ8j+UXFtNT47O7bOGOOBSUl0Ym6kID/lvNobgho8gDt9iPOzj3mzfmK0BbW gh3JqiSuhPVI8lePECGkE+E4C/dkFFfIN5yfKoHJjlDsJWzBmUaTMh6SNlJhAAWNme xHI+t8SowLsO/OUpZJ1xbnUOGeMdzTpYSkt4acsfqaQcPa+710QNEn2SjHb6NLE5Er WJRxdrTotgKoe4kx2YDERXewVNHC0ktpTGSnB+bGmIsI/NtiurWlpQkXMn6RT/HUPa MoBrTzlsjLTkw== Received: from authenticated.ozlabs.org (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail.ozlabs.org (Postfix) with ESMTPSA id 4VDKWN3F9pz4wxt; Tue, 9 Apr 2024 18:53:52 +1000 (AEST) From: Michael Ellerman To: Nathan Lynch via B4 Relay , Nicholas Piggin , Christophe Leroy , "Aneesh Kumar K.V" , "Naveen N. Rao" Subject: Re: [PATCH] powerpc/pseries: Enforce hcall result buffer validity and size In-Reply-To: <20240408-pseries-hvcall-retbuf-v1-1-ebc73d7253cf@linux.ibm.com> References: <20240408-pseries-hvcall-retbuf-v1-1-ebc73d7253cf@linux.ibm.com> Date: Tue, 09 Apr 2024 18:53:52 +1000 Message-ID: <874jcac3xb.fsf@mail.lhotse> MIME-Version: 1.0 Content-Type: text/plain X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Nathan Lynch , linuxppc-dev@lists.ozlabs.org Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" Nathan Lynch via B4 Relay writes: > From: Nathan Lynch > > plpar_hcall(), plpar_hcall9(), and related functions expect callers to > provide valid result buffers of certain minimum size. Currently this > is communicated only through comments in the code and the compiler has > no idea. > > For example, if I write a bug like this: > > long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE > plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...); > > This compiles with no diagnostics emitted, but likely results in stack > corruption at runtime when plpar_hcall9() stores results past the end > of the array. (To be clear this is a contrived example and I have not > found a real instance yet.) We did have some real stack corruption bugs in the past. I referred to them in my previous (much uglier) attempt at a fix: https://patchwork.ozlabs.org/project/linuxppc-dev/patch/1476780032-21643-2-git-send-email-mpe@ellerman.id.au/ Annoyingly I didn't describe them in any detail, but at least one of them was: 24c65bc7037e ("hwrng: pseries - port to new read API and fix stack corruption") Will this catch a case like that? Where the too-small buffer is not declared locally but rather comes into the function as a pointer? > To make this class of error less likely, we can use explicitly-sized > array parameters instead of pointers in the declarations for the hcall > APIs. When compiled with -Warray-bounds[1], the code above now > provokes a diagnostic like this: > > error: array argument is too small; > is of size 32, callee requires at least 72 [-Werror,-Warray-bounds] > 60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, > | ^ ~~~~~~ > > [1] Enabled for LLVM builds but not GCC for now. See commit > 0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and > related changes. clang build coverage is pretty good these days, so I think it's still worth doing. cheers > diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h > index a41e542ba94d..39cd1ca4ccb9 100644 > --- a/arch/powerpc/include/asm/hvcall.h > +++ b/arch/powerpc/include/asm/hvcall.h > @@ -524,7 +524,7 @@ long plpar_hcall_norets_notrace(unsigned long opcode, ...); > * Used for all but the craziest of phyp interfaces (see plpar_hcall9) > */ > #define PLPAR_HCALL_BUFSIZE 4 > -long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); > +long plpar_hcall(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); > > /** > * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats > @@ -538,7 +538,7 @@ long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); > * plpar_hcall, but plpar_hcall_raw works in real mode and does not > * calculate hypervisor call statistics. > */ > -long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); > +long plpar_hcall_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); > > /** > * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments > @@ -549,8 +549,8 @@ long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); > * PLPAR_HCALL9_BUFSIZE to size the return argument buffer. > */ > #define PLPAR_HCALL9_BUFSIZE 9 > -long plpar_hcall9(unsigned long opcode, unsigned long *retbuf, ...); > -long plpar_hcall9_raw(unsigned long opcode, unsigned long *retbuf, ...); > +long plpar_hcall9(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); > +long plpar_hcall9_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); > > /* pseries hcall tracing */ > extern struct static_key hcall_tracepoint_key; > > --- > base-commit: bfe51886ca544956eb4ff924d1937ac01d0ca9c8 > change-id: 20240408-pseries-hvcall-retbuf-c47c4d70d847 > > Best regards, > -- > Nathan Lynch