* [PATCH v4 1/3] cxl/pci: Rename DOE mailbox handle to doe_mb
2024-02-16 15:58 [PATCH v4 0/3] CDAT updates and fixes Robert Richter
@ 2024-02-16 15:58 ` Robert Richter
2024-02-16 15:58 ` [PATCH v4 2/3] cxl/pci: Get rid of pointer arithmetic reading CDAT table Robert Richter
2024-02-16 15:58 ` [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse() Robert Richter
2 siblings, 0 replies; 10+ messages in thread
From: Robert Richter @ 2024-02-16 15:58 UTC (permalink / raw)
To: Alison Schofield, Vishal Verma, Ira Weiny, Dan Williams,
Jonathan Cameron, Dave Jiang, Davidlohr Bueso, Jonathan Cameron
Cc: linux-cxl, linux-kernel, Rafael J. Wysocki, Len Brown,
Robert Richter
Trivial variable rename for the DOE mailbox handle from cdat_doe to
doe_mb. The variable name cdat_doe is too ambiguous, use doe_mb that
is commonly used for the mailbox.
Signed-off-by: Robert Richter <rrichter@amd.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
drivers/cxl/core/pci.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 480489f5644e..39366ce94985 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -518,14 +518,14 @@ EXPORT_SYMBOL_NS_GPL(cxl_hdm_decode_init, CXL);
FIELD_PREP(CXL_DOE_TABLE_ACCESS_ENTRY_HANDLE, (entry_handle)))
static int cxl_cdat_get_length(struct device *dev,
- struct pci_doe_mb *cdat_doe,
+ struct pci_doe_mb *doe_mb,
size_t *length)
{
__le32 request = CDAT_DOE_REQ(0);
__le32 response[2];
int rc;
- rc = pci_doe(cdat_doe, PCI_DVSEC_VENDOR_ID_CXL,
+ rc = pci_doe(doe_mb, PCI_DVSEC_VENDOR_ID_CXL,
CXL_DOE_PROTOCOL_TABLE_ACCESS,
&request, sizeof(request),
&response, sizeof(response));
@@ -543,7 +543,7 @@ static int cxl_cdat_get_length(struct device *dev,
}
static int cxl_cdat_read_table(struct device *dev,
- struct pci_doe_mb *cdat_doe,
+ struct pci_doe_mb *doe_mb,
void *cdat_table, size_t *cdat_length)
{
size_t length = *cdat_length + sizeof(__le32);
@@ -557,7 +557,7 @@ static int cxl_cdat_read_table(struct device *dev,
size_t entry_dw;
int rc;
- rc = pci_doe(cdat_doe, PCI_DVSEC_VENDOR_ID_CXL,
+ rc = pci_doe(doe_mb, PCI_DVSEC_VENDOR_ID_CXL,
CXL_DOE_PROTOCOL_TABLE_ACCESS,
&request, sizeof(request),
data, length);
@@ -617,7 +617,7 @@ void read_cdat_data(struct cxl_port *port)
{
struct device *uport = port->uport_dev;
struct device *dev = &port->dev;
- struct pci_doe_mb *cdat_doe;
+ struct pci_doe_mb *doe_mb;
struct pci_dev *pdev = NULL;
struct cxl_memdev *cxlmd;
size_t cdat_length;
@@ -638,16 +638,16 @@ void read_cdat_data(struct cxl_port *port)
if (!pdev)
return;
- cdat_doe = pci_find_doe_mailbox(pdev, PCI_DVSEC_VENDOR_ID_CXL,
- CXL_DOE_PROTOCOL_TABLE_ACCESS);
- if (!cdat_doe) {
+ doe_mb = pci_find_doe_mailbox(pdev, PCI_DVSEC_VENDOR_ID_CXL,
+ CXL_DOE_PROTOCOL_TABLE_ACCESS);
+ if (!doe_mb) {
dev_dbg(dev, "No CDAT mailbox\n");
return;
}
port->cdat_available = true;
- if (cxl_cdat_get_length(dev, cdat_doe, &cdat_length)) {
+ if (cxl_cdat_get_length(dev, doe_mb, &cdat_length)) {
dev_dbg(dev, "No CDAT length\n");
return;
}
@@ -656,7 +656,7 @@ void read_cdat_data(struct cxl_port *port)
if (!cdat_buf)
return;
- rc = cxl_cdat_read_table(dev, cdat_doe, cdat_buf, &cdat_length);
+ rc = cxl_cdat_read_table(dev, doe_mb, cdat_buf, &cdat_length);
if (rc)
goto err;
--
2.39.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH v4 2/3] cxl/pci: Get rid of pointer arithmetic reading CDAT table
2024-02-16 15:58 [PATCH v4 0/3] CDAT updates and fixes Robert Richter
2024-02-16 15:58 ` [PATCH v4 1/3] cxl/pci: Rename DOE mailbox handle to doe_mb Robert Richter
@ 2024-02-16 15:58 ` Robert Richter
2024-02-19 12:50 ` Jonathan Cameron
2024-02-16 15:58 ` [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse() Robert Richter
2 siblings, 1 reply; 10+ messages in thread
From: Robert Richter @ 2024-02-16 15:58 UTC (permalink / raw)
To: Alison Schofield, Vishal Verma, Ira Weiny, Dan Williams,
Jonathan Cameron, Dave Jiang, Davidlohr Bueso, Jonathan Cameron
Cc: linux-cxl, linux-kernel, Rafael J. Wysocki, Len Brown,
Robert Richter, Lukas Wunner, Fan Ni
Reading the CDAT table using DOE requires a Table Access Response
Header in addition to the CDAT entry. In current implementation this
has caused offsets with sizeof(__le32) to the actual buffers. This led
to hardly readable code and even bugs. E.g., see fix of devm_kfree()
in read_cdat_data():
c65efe3685f5 cxl/cdat: Free correct buffer on checksum error
Rework code to avoid calculations with sizeof(__le32). Introduce
struct cdat_doe_rsp for this which contains the Table Access Response
Header and a variable payload size for various data structures
afterwards to access the CDAT table and its CDAT Data Structures
without recalculating buffer offsets.
Cc: Lukas Wunner <lukas@wunner.de>
Cc: Fan Ni <nifan.cxl@gmail.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Robert Richter <rrichter@amd.com>
---
drivers/cxl/core/pci.c | 77 ++++++++++++++++++++++--------------------
drivers/cxl/cxlpci.h | 24 +++++++++++++
2 files changed, 65 insertions(+), 36 deletions(-)
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 39366ce94985..763c39456228 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -544,55 +544,57 @@ static int cxl_cdat_get_length(struct device *dev,
static int cxl_cdat_read_table(struct device *dev,
struct pci_doe_mb *doe_mb,
- void *cdat_table, size_t *cdat_length)
+ struct cdat_doe_rsp *rsp, size_t *length)
{
- size_t length = *cdat_length + sizeof(__le32);
- __le32 *data = cdat_table;
- int entry_handle = 0;
+ size_t received, remaining = *length;
+ unsigned int entry_handle = 0;
+ union cdat_data *data;
__le32 saved_dw = 0;
do {
__le32 request = CDAT_DOE_REQ(entry_handle);
- struct cdat_entry_header *entry;
- size_t entry_dw;
int rc;
rc = pci_doe(doe_mb, PCI_DVSEC_VENDOR_ID_CXL,
CXL_DOE_PROTOCOL_TABLE_ACCESS,
&request, sizeof(request),
- data, length);
+ rsp, sizeof(*rsp) + remaining);
if (rc < 0) {
dev_err(dev, "DOE failed: %d", rc);
return rc;
}
- /* 1 DW Table Access Response Header + CDAT entry */
- entry = (struct cdat_entry_header *)(data + 1);
- if ((entry_handle == 0 &&
- rc != sizeof(__le32) + sizeof(struct cdat_header)) ||
- (entry_handle > 0 &&
- (rc < sizeof(__le32) + sizeof(*entry) ||
- rc != sizeof(__le32) + le16_to_cpu(entry->length))))
+ if (rc < sizeof(*rsp))
return -EIO;
+ data = (union cdat_data *)rsp->data;
+ received = rc - sizeof(*rsp);
+
+ if (entry_handle == 0) {
+ if (received != sizeof(data->header))
+ return -EIO;
+ } else {
+ if (received < sizeof(data->entry) ||
+ received != le16_to_cpu(data->entry.length))
+ return -EIO;
+ }
+
/* Get the CXL table access header entry handle */
entry_handle = FIELD_GET(CXL_DOE_TABLE_ACCESS_ENTRY_HANDLE,
- le32_to_cpu(data[0]));
- entry_dw = rc / sizeof(__le32);
- /* Skip Header */
- entry_dw -= 1;
+ le32_to_cpu(rsp->doe_header));
+
/*
* Table Access Response Header overwrote the last DW of
* previous entry, so restore that DW
*/
- *data = saved_dw;
- length -= entry_dw * sizeof(__le32);
- data += entry_dw;
- saved_dw = *data;
+ rsp->doe_header = saved_dw;
+ remaining -= received;
+ rsp = (void *)rsp + received;
+ saved_dw = rsp->doe_header;
} while (entry_handle != CXL_DOE_TABLE_ACCESS_LAST_ENTRY);
/* Length in CDAT header may exceed concatenation of CDAT entries */
- *cdat_length -= length - sizeof(__le32);
+ *length -= remaining;
return 0;
}
@@ -620,8 +622,8 @@ void read_cdat_data(struct cxl_port *port)
struct pci_doe_mb *doe_mb;
struct pci_dev *pdev = NULL;
struct cxl_memdev *cxlmd;
- size_t cdat_length;
- void *cdat_table, *cdat_buf;
+ struct cdat_doe_rsp *buf;
+ size_t length;
int rc;
if (is_cxl_memdev(uport)) {
@@ -647,30 +649,33 @@ void read_cdat_data(struct cxl_port *port)
port->cdat_available = true;
- if (cxl_cdat_get_length(dev, doe_mb, &cdat_length)) {
+ if (cxl_cdat_get_length(dev, doe_mb, &length)) {
dev_dbg(dev, "No CDAT length\n");
return;
}
- cdat_buf = devm_kzalloc(dev, cdat_length + sizeof(__le32), GFP_KERNEL);
- if (!cdat_buf)
- return;
+ /*
+ * The begin of the CDAT buffer needs space for additional 4
+ * bytes for the DOE header. Table data starts afterwards.
+ */
+ buf = devm_kzalloc(dev, sizeof(*buf) + length, GFP_KERNEL);
+ if (!buf)
+ goto err;
- rc = cxl_cdat_read_table(dev, doe_mb, cdat_buf, &cdat_length);
+ rc = cxl_cdat_read_table(dev, doe_mb, buf, &length);
if (rc)
goto err;
- cdat_table = cdat_buf + sizeof(__le32);
- if (cdat_checksum(cdat_table, cdat_length))
+ if (cdat_checksum(buf->data, length))
goto err;
- port->cdat.table = cdat_table;
- port->cdat.length = cdat_length;
- return;
+ port->cdat.table = buf->data;
+ port->cdat.length = length;
+ return;
err:
/* Don't leave table data allocated on error */
- devm_kfree(dev, cdat_buf);
+ devm_kfree(dev, buf);
dev_err(dev, "Failed to read/validate CDAT.\n");
}
EXPORT_SYMBOL_NS_GPL(read_cdat_data, CXL);
diff --git a/drivers/cxl/cxlpci.h b/drivers/cxl/cxlpci.h
index 711b05d9a370..93992a1c8eec 100644
--- a/drivers/cxl/cxlpci.h
+++ b/drivers/cxl/cxlpci.h
@@ -71,6 +71,15 @@ enum cxl_regloc_type {
CXL_REGLOC_RBI_TYPES
};
+/*
+ * Table Access DOE, CDAT Read Entry Response
+ *
+ * Spec refs:
+ *
+ * CXL 3.1 8.1.11, Table 8-14: Read Entry Response
+ * CDAT Specification 1.03: 2 CDAT Data Structures
+ */
+
struct cdat_header {
__le32 length;
u8 revision;
@@ -85,6 +94,21 @@ struct cdat_entry_header {
__le16 length;
} __packed;
+/*
+ * The DOE CDAT read response contains a CDAT read entry (either the
+ * CDAT header or a structure).
+ */
+union cdat_data {
+ struct cdat_header header;
+ struct cdat_entry_header entry;
+} __packed;
+
+/* There is an additional CDAT response header of 4 bytes. */
+struct cdat_doe_rsp {
+ __le32 doe_header;
+ u8 data[];
+} __packed;
+
/*
* CXL v3.0 6.2.3 Table 6-4
* The table indicates that if PCIe Flit Mode is set, then CXL is in 256B flits
--
2.39.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v4 2/3] cxl/pci: Get rid of pointer arithmetic reading CDAT table
2024-02-16 15:58 ` [PATCH v4 2/3] cxl/pci: Get rid of pointer arithmetic reading CDAT table Robert Richter
@ 2024-02-19 12:50 ` Jonathan Cameron
2024-02-25 14:21 ` Robert Richter
0 siblings, 1 reply; 10+ messages in thread
From: Jonathan Cameron @ 2024-02-19 12:50 UTC (permalink / raw)
To: Robert Richter
Cc: Alison Schofield, Vishal Verma, Ira Weiny, Dan Williams,
Dave Jiang, Davidlohr Bueso, linux-cxl, linux-kernel,
Rafael J. Wysocki, Len Brown, Lukas Wunner, Fan Ni
On Fri, 16 Feb 2024 16:58:43 +0100
Robert Richter <rrichter@amd.com> wrote:
> Reading the CDAT table using DOE requires a Table Access Response
> Header in addition to the CDAT entry. In current implementation this
> has caused offsets with sizeof(__le32) to the actual buffers. This led
> to hardly readable code and even bugs. E.g., see fix of devm_kfree()
> in read_cdat_data():
>
> c65efe3685f5 cxl/cdat: Free correct buffer on checksum error
>
> Rework code to avoid calculations with sizeof(__le32). Introduce
> struct cdat_doe_rsp for this which contains the Table Access Response
> Header and a variable payload size for various data structures
> afterwards to access the CDAT table and its CDAT Data Structures
> without recalculating buffer offsets.
>
> Cc: Lukas Wunner <lukas@wunner.de>
> Cc: Fan Ni <nifan.cxl@gmail.com>
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> Signed-off-by: Robert Richter <rrichter@amd.com>
Ok. I suspect we could fine tune this for ever but changes here look good
enough to me and definitely nicer than the original ;)
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> ---
> drivers/cxl/core/pci.c | 77 ++++++++++++++++++++++--------------------
> drivers/cxl/cxlpci.h | 24 +++++++++++++
> 2 files changed, 65 insertions(+), 36 deletions(-)
>
> diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
> index 39366ce94985..763c39456228 100644
> --- a/drivers/cxl/core/pci.c
> +++ b/drivers/cxl/core/pci.c
> @@ -544,55 +544,57 @@ static int cxl_cdat_get_length(struct device *dev,
>
> static int cxl_cdat_read_table(struct device *dev,
> struct pci_doe_mb *doe_mb,
> - void *cdat_table, size_t *cdat_length)
> + struct cdat_doe_rsp *rsp, size_t *length)
> {
> - size_t length = *cdat_length + sizeof(__le32);
> - __le32 *data = cdat_table;
> - int entry_handle = 0;
> + size_t received, remaining = *length;
> + unsigned int entry_handle = 0;
> + union cdat_data *data;
> __le32 saved_dw = 0;
>
> do {
> __le32 request = CDAT_DOE_REQ(entry_handle);
> - struct cdat_entry_header *entry;
> - size_t entry_dw;
> int rc;
>
> rc = pci_doe(doe_mb, PCI_DVSEC_VENDOR_ID_CXL,
> CXL_DOE_PROTOCOL_TABLE_ACCESS,
> &request, sizeof(request),
> - data, length);
> + rsp, sizeof(*rsp) + remaining);
> if (rc < 0) {
> dev_err(dev, "DOE failed: %d", rc);
> return rc;
> }
>
> - /* 1 DW Table Access Response Header + CDAT entry */
> - entry = (struct cdat_entry_header *)(data + 1);
> - if ((entry_handle == 0 &&
> - rc != sizeof(__le32) + sizeof(struct cdat_header)) ||
> - (entry_handle > 0 &&
> - (rc < sizeof(__le32) + sizeof(*entry) ||
> - rc != sizeof(__le32) + le16_to_cpu(entry->length))))
> + if (rc < sizeof(*rsp))
> return -EIO;
>
> + data = (union cdat_data *)rsp->data;
> + received = rc - sizeof(*rsp);
> +
> + if (entry_handle == 0) {
> + if (received != sizeof(data->header))
> + return -EIO;
> + } else {
> + if (received < sizeof(data->entry) ||
> + received != le16_to_cpu(data->entry.length))
> + return -EIO;
> + }
> +
> /* Get the CXL table access header entry handle */
> entry_handle = FIELD_GET(CXL_DOE_TABLE_ACCESS_ENTRY_HANDLE,
> - le32_to_cpu(data[0]));
> - entry_dw = rc / sizeof(__le32);
> - /* Skip Header */
> - entry_dw -= 1;
> + le32_to_cpu(rsp->doe_header));
> +
> /*
> * Table Access Response Header overwrote the last DW of
> * previous entry, so restore that DW
> */
> - *data = saved_dw;
> - length -= entry_dw * sizeof(__le32);
> - data += entry_dw;
> - saved_dw = *data;
> + rsp->doe_header = saved_dw;
> + remaining -= received;
> + rsp = (void *)rsp + received;
> + saved_dw = rsp->doe_header;
> } while (entry_handle != CXL_DOE_TABLE_ACCESS_LAST_ENTRY);
>
> /* Length in CDAT header may exceed concatenation of CDAT entries */
> - *cdat_length -= length - sizeof(__le32);
> + *length -= remaining;
>
> return 0;
> }
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH v4 2/3] cxl/pci: Get rid of pointer arithmetic reading CDAT table
2024-02-19 12:50 ` Jonathan Cameron
@ 2024-02-25 14:21 ` Robert Richter
0 siblings, 0 replies; 10+ messages in thread
From: Robert Richter @ 2024-02-25 14:21 UTC (permalink / raw)
To: Jonathan Cameron
Cc: Alison Schofield, Vishal Verma, Ira Weiny, Dan Williams,
Dave Jiang, Davidlohr Bueso, linux-cxl, linux-kernel,
Rafael J. Wysocki, Len Brown, Lukas Wunner, Fan Ni
On 19.02.24 12:50:59, Jonathan Cameron wrote:
> On Fri, 16 Feb 2024 16:58:43 +0100
> Robert Richter <rrichter@amd.com> wrote:
>
> > Reading the CDAT table using DOE requires a Table Access Response
> > Header in addition to the CDAT entry. In current implementation this
> > has caused offsets with sizeof(__le32) to the actual buffers. This led
> > to hardly readable code and even bugs. E.g., see fix of devm_kfree()
> > in read_cdat_data():
> >
> > c65efe3685f5 cxl/cdat: Free correct buffer on checksum error
> >
> > Rework code to avoid calculations with sizeof(__le32). Introduce
> > struct cdat_doe_rsp for this which contains the Table Access Response
> > Header and a variable payload size for various data structures
> > afterwards to access the CDAT table and its CDAT Data Structures
> > without recalculating buffer offsets.
> >
> > Cc: Lukas Wunner <lukas@wunner.de>
> > Cc: Fan Ni <nifan.cxl@gmail.com>
> > Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> > Signed-off-by: Robert Richter <rrichter@amd.com>
> Ok. I suspect we could fine tune this for ever but changes here look good
> enough to me and definitely nicer than the original ;)
>
> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Thanks for your review of this series and also the v5 update for patch
#3.
-Robert
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
2024-02-16 15:58 [PATCH v4 0/3] CDAT updates and fixes Robert Richter
2024-02-16 15:58 ` [PATCH v4 1/3] cxl/pci: Rename DOE mailbox handle to doe_mb Robert Richter
2024-02-16 15:58 ` [PATCH v4 2/3] cxl/pci: Get rid of pointer arithmetic reading CDAT table Robert Richter
@ 2024-02-16 15:58 ` Robert Richter
2024-02-17 10:43 ` kernel test robot
2024-02-18 12:58 ` [PATCH v4 3/3] " kernel test robot
2 siblings, 2 replies; 10+ messages in thread
From: Robert Richter @ 2024-02-16 15:58 UTC (permalink / raw)
To: Alison Schofield, Vishal Verma, Ira Weiny, Dan Williams,
Jonathan Cameron, Dave Jiang, Davidlohr Bueso, Rafael J. Wysocki,
Jonathan Cameron, Andrew Morton
Cc: linux-cxl, linux-kernel, Len Brown, Robert Richter, linux-acpi
There exist card implementations with a CDAT table using a fixed size
buffer, but with entries filled in that do not fill the whole table
length size. Then, the last entry in the CDAT table may not mark the
end of the CDAT table buffer specified by the length field in the CDAT
header. It can be shorter with trailing unused (zero'ed) data. The
actual table length is determined while reading all CDAT entries of
the table with DOE.
If the table is greater than expected (containing zero'ed trailing
data), the CDAT parser fails with:
[ 48.691717] Malformed DSMAS table length: (24:0)
[ 48.702084] [CDAT:0x00] Invalid zero length
[ 48.711460] cxl_port endpoint1: Failed to parse CDAT: -22
In addition, a check of the table buffer length is missing to prevent
an out-of-bound access then parsing the CDAT table.
Hardening code against device returning borked table. Fix that by
providing an optional buffer length argument to
acpi_parse_entries_array() that can be used by cdat_table_parse() to
propagate the buffer size down to its users to check the buffer
length. This also prevents a possible out-of-bound access mentioned.
Add a check to warn about a malformed CDAT table length.
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Len Brown <lenb@kernel.org>
Signed-off-by: Robert Richter <rrichter@amd.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Robert Richter <rrichter@amd.com>
---
drivers/acpi/tables.c | 2 +-
drivers/cxl/core/cdat.c | 6 +++---
drivers/cxl/core/pci.c | 8 +++++++-
include/linux/fw_table.h | 4 +++-
lib/fw_table.c | 15 ++++++++++-----
5 files changed, 24 insertions(+), 11 deletions(-)
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index b07f7d091d13..b976e5fc3fbc 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -253,7 +253,7 @@ int __init_or_acpilib acpi_table_parse_entries_array(
count = acpi_parse_entries_array(id, table_size,
(union fw_table_header *)table_header,
- proc, proc_num, max_entries);
+ 0, proc, proc_num, max_entries);
acpi_put_table(table_header);
return count;
diff --git a/drivers/cxl/core/cdat.c b/drivers/cxl/core/cdat.c
index 6fe11546889f..012d8f2a7945 100644
--- a/drivers/cxl/core/cdat.c
+++ b/drivers/cxl/core/cdat.c
@@ -149,13 +149,13 @@ static int cxl_cdat_endpoint_process(struct cxl_port *port,
int rc;
rc = cdat_table_parse(ACPI_CDAT_TYPE_DSMAS, cdat_dsmas_handler,
- dsmas_xa, port->cdat.table);
+ dsmas_xa, port->cdat.table, port->cdat.length);
rc = cdat_table_parse_output(rc);
if (rc)
return rc;
rc = cdat_table_parse(ACPI_CDAT_TYPE_DSLBIS, cdat_dslbis_handler,
- dsmas_xa, port->cdat.table);
+ dsmas_xa, port->cdat.table, port->cdat.length);
return cdat_table_parse_output(rc);
}
@@ -511,7 +511,7 @@ void cxl_switch_parse_cdat(struct cxl_port *port)
return;
rc = cdat_table_parse(ACPI_CDAT_TYPE_SSLBIS, cdat_sslbis_handler,
- port, port->cdat.table);
+ port, port->cdat.table, port->cdat.length);
rc = cdat_table_parse_output(rc);
if (rc)
dev_dbg(&port->dev, "Failed to parse SSLBIS: %d\n", rc);
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 763c39456228..a0e7ed5ae25f 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -623,7 +623,7 @@ void read_cdat_data(struct cxl_port *port)
struct pci_dev *pdev = NULL;
struct cxl_memdev *cxlmd;
struct cdat_doe_rsp *buf;
- size_t length;
+ size_t table_length, length;
int rc;
if (is_cxl_memdev(uport)) {
@@ -662,10 +662,16 @@ void read_cdat_data(struct cxl_port *port)
if (!buf)
goto err;
+ table_length = length;
+
rc = cxl_cdat_read_table(dev, doe_mb, buf, &length);
if (rc)
goto err;
+ if (table_length != length)
+ dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
+ table_length, length);
+
if (cdat_checksum(buf->data, length))
goto err;
diff --git a/include/linux/fw_table.h b/include/linux/fw_table.h
index 95421860397a..3ff4c277296f 100644
--- a/include/linux/fw_table.h
+++ b/include/linux/fw_table.h
@@ -40,12 +40,14 @@ union acpi_subtable_headers {
int acpi_parse_entries_array(char *id, unsigned long table_size,
union fw_table_header *table_header,
+ unsigned long max_length,
struct acpi_subtable_proc *proc,
int proc_num, unsigned int max_entries);
int cdat_table_parse(enum acpi_cdat_type type,
acpi_tbl_entry_handler_arg handler_arg, void *arg,
- struct acpi_table_cdat *table_header);
+ struct acpi_table_cdat *table_header,
+ unsigned long length);
/* CXL is the only non-ACPI consumer of the FIRMWARE_TABLE library */
#if IS_ENABLED(CONFIG_ACPI) && !IS_ENABLED(CONFIG_CXL_BUS)
diff --git a/lib/fw_table.c b/lib/fw_table.c
index c3569d2ba503..16291814450e 100644
--- a/lib/fw_table.c
+++ b/lib/fw_table.c
@@ -127,6 +127,7 @@ static __init_or_fwtbl_lib int call_handler(struct acpi_subtable_proc *proc,
*
* @id: table id (for debugging purposes)
* @table_size: size of the root table
+ * @max_length: maximum size of the table (ignore if 0)
* @table_header: where does the table start?
* @proc: array of acpi_subtable_proc struct containing entry id
* and associated handler with it
@@ -148,18 +149,21 @@ static __init_or_fwtbl_lib int call_handler(struct acpi_subtable_proc *proc,
int __init_or_fwtbl_lib
acpi_parse_entries_array(char *id, unsigned long table_size,
union fw_table_header *table_header,
+ unsigned long max_length,
struct acpi_subtable_proc *proc,
int proc_num, unsigned int max_entries)
{
- unsigned long table_end, subtable_len, entry_len;
+ unsigned long table_len, table_end, subtable_len, entry_len;
struct acpi_subtable_entry entry;
enum acpi_subtable_type type;
int count = 0;
int i;
type = acpi_get_subtable_type(id);
- table_end = (unsigned long)table_header +
- acpi_table_get_length(type, table_header);
+ table_len = acpi_table_get_length(type, table_header);
+ if (max_length && max_length < table_len)
+ table_len = max_length;
+ table_end = (unsigned long)table_header + table_len;
/* Parse all entries looking for a match. */
@@ -208,7 +212,8 @@ int __init_or_fwtbl_lib
cdat_table_parse(enum acpi_cdat_type type,
acpi_tbl_entry_handler_arg handler_arg,
void *arg,
- struct acpi_table_cdat *table_header)
+ struct acpi_table_cdat *table_header,
+ unsigned long length)
{
struct acpi_subtable_proc proc = {
.id = type,
@@ -222,6 +227,6 @@ cdat_table_parse(enum acpi_cdat_type type,
return acpi_parse_entries_array(ACPI_SIG_CDAT,
sizeof(struct acpi_table_cdat),
(union fw_table_header *)table_header,
- &proc, 1, 0);
+ length, &proc, 1, 0);
}
EXPORT_SYMBOL_FWTBL_LIB(cdat_table_parse);
--
2.39.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
2024-02-16 15:58 ` [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse() Robert Richter
@ 2024-02-17 10:43 ` kernel test robot
2024-02-17 21:39 ` [PATCH v5] " Robert Richter
2024-02-18 12:58 ` [PATCH v4 3/3] " kernel test robot
1 sibling, 1 reply; 10+ messages in thread
From: kernel test robot @ 2024-02-17 10:43 UTC (permalink / raw)
To: Robert Richter, Alison Schofield, Vishal Verma, Ira Weiny,
Dan Williams, Jonathan Cameron, Dave Jiang, Davidlohr Bueso,
Rafael J. Wysocki, Andrew Morton
Cc: oe-kbuild-all, Linux Memory Management List, linux-cxl,
linux-kernel, Len Brown, Robert Richter, linux-acpi
Hi Robert,
kernel test robot noticed the following build warnings:
[auto build test WARNING on 6be99530c92c6b8ff7a01903edc42393575ad63b]
url: https://github.com/intel-lab-lkp/linux/commits/Robert-Richter/cxl-pci-Rename-DOE-mailbox-handle-to-doe_mb/20240217-000206
base: 6be99530c92c6b8ff7a01903edc42393575ad63b
patch link: https://lore.kernel.org/r/20240216155844.406996-4-rrichter%40amd.com
patch subject: [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
config: arc-allyesconfig (https://download.01.org/0day-ci/archive/20240217/202402171817.i0WShbft-lkp@intel.com/config)
compiler: arceb-elf-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240217/202402171817.i0WShbft-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202402171817.i0WShbft-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from include/linux/device.h:15,
from drivers/cxl/core/pci.c:5:
drivers/cxl/core/pci.c: In function 'read_cdat_data':
>> drivers/cxl/core/pci.c:672:31: warning: format '%lu' expects argument of type 'long unsigned int', but argument 3 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/dev_printk.h:110:30: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
include/linux/dev_printk.h:146:61: note: in expansion of macro 'dev_fmt'
146 | dev_printk_index_wrap(_dev_warn, KERN_WARNING, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~
drivers/cxl/core/pci.c:672:17: note: in expansion of macro 'dev_warn'
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ^~~~~~~~
drivers/cxl/core/pci.c:672:63: note: format string is defined here
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ~~^
| |
| long unsigned int
| %u
drivers/cxl/core/pci.c:672:31: warning: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/dev_printk.h:110:30: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
include/linux/dev_printk.h:146:61: note: in expansion of macro 'dev_fmt'
146 | dev_printk_index_wrap(_dev_warn, KERN_WARNING, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~
drivers/cxl/core/pci.c:672:17: note: in expansion of macro 'dev_warn'
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ^~~~~~~~
drivers/cxl/core/pci.c:672:67: note: format string is defined here
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ~~^
| |
| long unsigned int
| %u
during RTL pass: mach
drivers/cxl/core/pci.c: In function 'match_add_dports':
drivers/cxl/core/pci.c:68:1: internal compiler error: in arc_ifcvt, at config/arc/arc.cc:9703
68 | }
| ^
0x5b78c1 arc_ifcvt
/tmp/build-crosstools-gcc-13.2.0-binutils-2.41/gcc/gcc-13.2.0/gcc/config/arc/arc.cc:9703
0xe431b4 arc_reorg
/tmp/build-crosstools-gcc-13.2.0-binutils-2.41/gcc/gcc-13.2.0/gcc/config/arc/arc.cc:8552
0xaed299 execute
/tmp/build-crosstools-gcc-13.2.0-binutils-2.41/gcc/gcc-13.2.0/gcc/reorg.cc:3927
Please submit a full bug report, with preprocessed source (by using -freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
vim +672 drivers/cxl/core/pci.c
611
612 /**
613 * read_cdat_data - Read the CDAT data on this port
614 * @port: Port to read data from
615 *
616 * This call will sleep waiting for responses from the DOE mailbox.
617 */
618 void read_cdat_data(struct cxl_port *port)
619 {
620 struct device *uport = port->uport_dev;
621 struct device *dev = &port->dev;
622 struct pci_doe_mb *doe_mb;
623 struct pci_dev *pdev = NULL;
624 struct cxl_memdev *cxlmd;
625 struct cdat_doe_rsp *buf;
626 size_t table_length, length;
627 int rc;
628
629 if (is_cxl_memdev(uport)) {
630 struct device *host;
631
632 cxlmd = to_cxl_memdev(uport);
633 host = cxlmd->dev.parent;
634 if (dev_is_pci(host))
635 pdev = to_pci_dev(host);
636 } else if (dev_is_pci(uport)) {
637 pdev = to_pci_dev(uport);
638 }
639
640 if (!pdev)
641 return;
642
643 doe_mb = pci_find_doe_mailbox(pdev, PCI_DVSEC_VENDOR_ID_CXL,
644 CXL_DOE_PROTOCOL_TABLE_ACCESS);
645 if (!doe_mb) {
646 dev_dbg(dev, "No CDAT mailbox\n");
647 return;
648 }
649
650 port->cdat_available = true;
651
652 if (cxl_cdat_get_length(dev, doe_mb, &length)) {
653 dev_dbg(dev, "No CDAT length\n");
654 return;
655 }
656
657 /*
658 * The begin of the CDAT buffer needs space for additional 4
659 * bytes for the DOE header. Table data starts afterwards.
660 */
661 buf = devm_kzalloc(dev, sizeof(*buf) + length, GFP_KERNEL);
662 if (!buf)
663 goto err;
664
665 table_length = length;
666
667 rc = cxl_cdat_read_table(dev, doe_mb, buf, &length);
668 if (rc)
669 goto err;
670
671 if (table_length != length)
> 672 dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
673 table_length, length);
674
675 if (cdat_checksum(buf->data, length))
676 goto err;
677
678 port->cdat.table = buf->data;
679 port->cdat.length = length;
680
681 return;
682 err:
683 /* Don't leave table data allocated on error */
684 devm_kfree(dev, buf);
685 dev_err(dev, "Failed to read/validate CDAT.\n");
686 }
687 EXPORT_SYMBOL_NS_GPL(read_cdat_data, CXL);
688
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH v5] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
2024-02-17 10:43 ` kernel test robot
@ 2024-02-17 21:39 ` Robert Richter
2024-02-19 12:53 ` Jonathan Cameron
0 siblings, 1 reply; 10+ messages in thread
From: Robert Richter @ 2024-02-17 21:39 UTC (permalink / raw)
To: Dan Williams
Cc: kernel test robot, Alison Schofield, Vishal Verma, Ira Weiny,
Jonathan Cameron, Dave Jiang, Davidlohr Bueso, Rafael J. Wysocki,
Andrew Morton, oe-kbuild-all, Linux Memory Management List,
linux-cxl, linux-kernel, Len Brown, linux-acpi
On 17.02.24 18:43:37, kernel test robot wrote:
> Hi Robert,
>
> kernel test robot noticed the following build warnings:
>
> [auto build test WARNING on 6be99530c92c6b8ff7a01903edc42393575ad63b]
>
> url: https://github.com/intel-lab-lkp/linux/commits/Robert-Richter/cxl-pci-Rename-DOE-mailbox-handle-to-doe_mb/20240217-000206
> base: 6be99530c92c6b8ff7a01903edc42393575ad63b
> patch link: https://lore.kernel.org/r/20240216155844.406996-4-rrichter%40amd.com
> patch subject: [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
> config: arc-allyesconfig (https://download.01.org/0day-ci/archive/20240217/202402171817.i0WShbft-lkp@intel.com/config)
> compiler: arceb-elf-gcc (GCC) 13.2.0
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240217/202402171817.i0WShbft-lkp@intel.com/reproduce)
> In file included from include/linux/device.h:15,
> from drivers/cxl/core/pci.c:5:
> drivers/cxl/core/pci.c: In function 'read_cdat_data':
> >> drivers/cxl/core/pci.c:672:31: warning: format '%lu' expects argument of type 'long unsigned int', but argument 3 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
> 672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
> | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fix below, it basically uses %zu for both format strings.
-Robert
From 08685053a91e370fd1263b921aa3e8942025c4e4 Mon Sep 17 00:00:00 2001
From: Robert Richter <rrichter@amd.com>
Date: Sun, 7 Jan 2024 18:13:16 +0100
Subject: [PATCH v5] lib/firmware_table: Provide buffer length argument to
cdat_table_parse()
There exist card implementations with a CDAT table using a fixed size
buffer, but with entries filled in that do not fill the whole table
length size. Then, the last entry in the CDAT table may not mark the
end of the CDAT table buffer specified by the length field in the CDAT
header. It can be shorter with trailing unused (zero'ed) data. The
actual table length is determined while reading all CDAT entries of
the table with DOE.
If the table is greater than expected (containing zero'ed trailing
data), the CDAT parser fails with:
[ 48.691717] Malformed DSMAS table length: (24:0)
[ 48.702084] [CDAT:0x00] Invalid zero length
[ 48.711460] cxl_port endpoint1: Failed to parse CDAT: -22
In addition, a check of the table buffer length is missing to prevent
an out-of-bound access then parsing the CDAT table.
Hardening code against device returning borked table. Fix that by
providing an optional buffer length argument to
acpi_parse_entries_array() that can be used by cdat_table_parse() to
propagate the buffer size down to its users to check the buffer
length. This also prevents a possible out-of-bound access mentioned.
Add a check to warn about a malformed CDAT table length.
Cc: "Rafael J. Wysocki" <rafael@kernel.org>
Cc: Len Brown <lenb@kernel.org>
Signed-off-by: Robert Richter <rrichter@amd.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Robert Richter <rrichter@amd.com>
---
drivers/acpi/tables.c | 2 +-
drivers/cxl/core/cdat.c | 6 +++---
drivers/cxl/core/pci.c | 8 +++++++-
include/linux/fw_table.h | 4 +++-
lib/fw_table.c | 15 ++++++++++-----
5 files changed, 24 insertions(+), 11 deletions(-)
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index b07f7d091d13..b976e5fc3fbc 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -253,7 +253,7 @@ int __init_or_acpilib acpi_table_parse_entries_array(
count = acpi_parse_entries_array(id, table_size,
(union fw_table_header *)table_header,
- proc, proc_num, max_entries);
+ 0, proc, proc_num, max_entries);
acpi_put_table(table_header);
return count;
diff --git a/drivers/cxl/core/cdat.c b/drivers/cxl/core/cdat.c
index 6fe11546889f..012d8f2a7945 100644
--- a/drivers/cxl/core/cdat.c
+++ b/drivers/cxl/core/cdat.c
@@ -149,13 +149,13 @@ static int cxl_cdat_endpoint_process(struct cxl_port *port,
int rc;
rc = cdat_table_parse(ACPI_CDAT_TYPE_DSMAS, cdat_dsmas_handler,
- dsmas_xa, port->cdat.table);
+ dsmas_xa, port->cdat.table, port->cdat.length);
rc = cdat_table_parse_output(rc);
if (rc)
return rc;
rc = cdat_table_parse(ACPI_CDAT_TYPE_DSLBIS, cdat_dslbis_handler,
- dsmas_xa, port->cdat.table);
+ dsmas_xa, port->cdat.table, port->cdat.length);
return cdat_table_parse_output(rc);
}
@@ -511,7 +511,7 @@ void cxl_switch_parse_cdat(struct cxl_port *port)
return;
rc = cdat_table_parse(ACPI_CDAT_TYPE_SSLBIS, cdat_sslbis_handler,
- port, port->cdat.table);
+ port, port->cdat.table, port->cdat.length);
rc = cdat_table_parse_output(rc);
if (rc)
dev_dbg(&port->dev, "Failed to parse SSLBIS: %d\n", rc);
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index 763c39456228..4e07465bf29e 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -623,7 +623,7 @@ void read_cdat_data(struct cxl_port *port)
struct pci_dev *pdev = NULL;
struct cxl_memdev *cxlmd;
struct cdat_doe_rsp *buf;
- size_t length;
+ size_t table_length, length;
int rc;
if (is_cxl_memdev(uport)) {
@@ -662,10 +662,16 @@ void read_cdat_data(struct cxl_port *port)
if (!buf)
goto err;
+ table_length = length;
+
rc = cxl_cdat_read_table(dev, doe_mb, buf, &length);
if (rc)
goto err;
+ if (table_length != length)
+ dev_warn(dev, "Malformed CDAT table length (%zu:%zu), discarding trailing data\n",
+ table_length, length);
+
if (cdat_checksum(buf->data, length))
goto err;
diff --git a/include/linux/fw_table.h b/include/linux/fw_table.h
index 95421860397a..3ff4c277296f 100644
--- a/include/linux/fw_table.h
+++ b/include/linux/fw_table.h
@@ -40,12 +40,14 @@ union acpi_subtable_headers {
int acpi_parse_entries_array(char *id, unsigned long table_size,
union fw_table_header *table_header,
+ unsigned long max_length,
struct acpi_subtable_proc *proc,
int proc_num, unsigned int max_entries);
int cdat_table_parse(enum acpi_cdat_type type,
acpi_tbl_entry_handler_arg handler_arg, void *arg,
- struct acpi_table_cdat *table_header);
+ struct acpi_table_cdat *table_header,
+ unsigned long length);
/* CXL is the only non-ACPI consumer of the FIRMWARE_TABLE library */
#if IS_ENABLED(CONFIG_ACPI) && !IS_ENABLED(CONFIG_CXL_BUS)
diff --git a/lib/fw_table.c b/lib/fw_table.c
index c3569d2ba503..16291814450e 100644
--- a/lib/fw_table.c
+++ b/lib/fw_table.c
@@ -127,6 +127,7 @@ static __init_or_fwtbl_lib int call_handler(struct acpi_subtable_proc *proc,
*
* @id: table id (for debugging purposes)
* @table_size: size of the root table
+ * @max_length: maximum size of the table (ignore if 0)
* @table_header: where does the table start?
* @proc: array of acpi_subtable_proc struct containing entry id
* and associated handler with it
@@ -148,18 +149,21 @@ static __init_or_fwtbl_lib int call_handler(struct acpi_subtable_proc *proc,
int __init_or_fwtbl_lib
acpi_parse_entries_array(char *id, unsigned long table_size,
union fw_table_header *table_header,
+ unsigned long max_length,
struct acpi_subtable_proc *proc,
int proc_num, unsigned int max_entries)
{
- unsigned long table_end, subtable_len, entry_len;
+ unsigned long table_len, table_end, subtable_len, entry_len;
struct acpi_subtable_entry entry;
enum acpi_subtable_type type;
int count = 0;
int i;
type = acpi_get_subtable_type(id);
- table_end = (unsigned long)table_header +
- acpi_table_get_length(type, table_header);
+ table_len = acpi_table_get_length(type, table_header);
+ if (max_length && max_length < table_len)
+ table_len = max_length;
+ table_end = (unsigned long)table_header + table_len;
/* Parse all entries looking for a match. */
@@ -208,7 +212,8 @@ int __init_or_fwtbl_lib
cdat_table_parse(enum acpi_cdat_type type,
acpi_tbl_entry_handler_arg handler_arg,
void *arg,
- struct acpi_table_cdat *table_header)
+ struct acpi_table_cdat *table_header,
+ unsigned long length)
{
struct acpi_subtable_proc proc = {
.id = type,
@@ -222,6 +227,6 @@ cdat_table_parse(enum acpi_cdat_type type,
return acpi_parse_entries_array(ACPI_SIG_CDAT,
sizeof(struct acpi_table_cdat),
(union fw_table_header *)table_header,
- &proc, 1, 0);
+ length, &proc, 1, 0);
}
EXPORT_SYMBOL_FWTBL_LIB(cdat_table_parse);
--
2.39.2
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v5] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
2024-02-17 21:39 ` [PATCH v5] " Robert Richter
@ 2024-02-19 12:53 ` Jonathan Cameron
0 siblings, 0 replies; 10+ messages in thread
From: Jonathan Cameron @ 2024-02-19 12:53 UTC (permalink / raw)
To: Robert Richter
Cc: Dan Williams, kernel test robot, Alison Schofield, Vishal Verma,
Ira Weiny, Dave Jiang, Davidlohr Bueso, Rafael J. Wysocki,
Andrew Morton, oe-kbuild-all, Linux Memory Management List,
linux-cxl, linux-kernel, Len Brown, linux-acpi
On Sat, 17 Feb 2024 22:39:46 +0100
Robert Richter <rrichter@amd.com> wrote:
> On 17.02.24 18:43:37, kernel test robot wrote:
> > Hi Robert,
> >
> > kernel test robot noticed the following build warnings:
> >
> > [auto build test WARNING on 6be99530c92c6b8ff7a01903edc42393575ad63b]
> >
> > url: https://github.com/intel-lab-lkp/linux/commits/Robert-Richter/cxl-pci-Rename-DOE-mailbox-handle-to-doe_mb/20240217-000206
> > base: 6be99530c92c6b8ff7a01903edc42393575ad63b
> > patch link: https://lore.kernel.org/r/20240216155844.406996-4-rrichter%40amd.com
> > patch subject: [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
> > config: arc-allyesconfig (https://download.01.org/0day-ci/archive/20240217/202402171817.i0WShbft-lkp@intel.com/config)
> > compiler: arceb-elf-gcc (GCC) 13.2.0
> > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240217/202402171817.i0WShbft-lkp@intel.com/reproduce)
>
> > In file included from include/linux/device.h:15,
> > from drivers/cxl/core/pci.c:5:
> > drivers/cxl/core/pci.c: In function 'read_cdat_data':
> > >> drivers/cxl/core/pci.c:672:31: warning: format '%lu' expects argument of type 'long unsigned int', but argument 3 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
> > 672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
> > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Fix below, it basically uses %zu for both format strings.
>
> -Robert
>
>
> From 08685053a91e370fd1263b921aa3e8942025c4e4 Mon Sep 17 00:00:00 2001
> From: Robert Richter <rrichter@amd.com>
> Date: Sun, 7 Jan 2024 18:13:16 +0100
> Subject: [PATCH v5] lib/firmware_table: Provide buffer length argument to
> cdat_table_parse()
>
> There exist card implementations with a CDAT table using a fixed size
> buffer, but with entries filled in that do not fill the whole table
> length size. Then, the last entry in the CDAT table may not mark the
> end of the CDAT table buffer specified by the length field in the CDAT
> header. It can be shorter with trailing unused (zero'ed) data. The
> actual table length is determined while reading all CDAT entries of
> the table with DOE.
>
> If the table is greater than expected (containing zero'ed trailing
> data), the CDAT parser fails with:
>
> [ 48.691717] Malformed DSMAS table length: (24:0)
> [ 48.702084] [CDAT:0x00] Invalid zero length
> [ 48.711460] cxl_port endpoint1: Failed to parse CDAT: -22
>
> In addition, a check of the table buffer length is missing to prevent
> an out-of-bound access then parsing the CDAT table.
>
> Hardening code against device returning borked table. Fix that by
> providing an optional buffer length argument to
> acpi_parse_entries_array() that can be used by cdat_table_parse() to
> propagate the buffer size down to its users to check the buffer
> length. This also prevents a possible out-of-bound access mentioned.
>
> Add a check to warn about a malformed CDAT table length.
>
> Cc: "Rafael J. Wysocki" <rafael@kernel.org>
> Cc: Len Brown <lenb@kernel.org>
> Signed-off-by: Robert Richter <rrichter@amd.com>
> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
> Signed-off-by: Robert Richter <rrichter@amd.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
2024-02-16 15:58 ` [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse() Robert Richter
2024-02-17 10:43 ` kernel test robot
@ 2024-02-18 12:58 ` kernel test robot
1 sibling, 0 replies; 10+ messages in thread
From: kernel test robot @ 2024-02-18 12:58 UTC (permalink / raw)
To: Robert Richter, Alison Schofield, Vishal Verma, Ira Weiny,
Dan Williams, Jonathan Cameron, Dave Jiang, Davidlohr Bueso,
Rafael J. Wysocki, Andrew Morton
Cc: llvm, oe-kbuild-all, Linux Memory Management List, linux-cxl,
linux-kernel, Len Brown, Robert Richter, linux-acpi
Hi Robert,
kernel test robot noticed the following build warnings:
[auto build test WARNING on 6be99530c92c6b8ff7a01903edc42393575ad63b]
url: https://github.com/intel-lab-lkp/linux/commits/Robert-Richter/cxl-pci-Rename-DOE-mailbox-handle-to-doe_mb/20240217-000206
base: 6be99530c92c6b8ff7a01903edc42393575ad63b
patch link: https://lore.kernel.org/r/20240216155844.406996-4-rrichter%40amd.com
patch subject: [PATCH v4 3/3] lib/firmware_table: Provide buffer length argument to cdat_table_parse()
config: i386-randconfig-006-20240217 (https://download.01.org/0day-ci/archive/20240218/202402182055.zfTIyfls-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240218/202402182055.zfTIyfls-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202402182055.zfTIyfls-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/cxl/core/pci.c:673:4: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat]
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ~~~
| %zu
673 | table_length, length);
| ^~~~~~~~~~~~
include/linux/dev_printk.h:146:70: note: expanded from macro 'dev_warn'
146 | dev_printk_index_wrap(_dev_warn, KERN_WARNING, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ~~~ ^~~~~~~~~~~
drivers/cxl/core/pci.c:673:18: warning: format specifies type 'unsigned long' but the argument has type 'size_t' (aka 'unsigned int') [-Wformat]
672 | dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
| ~~~
| %zu
673 | table_length, length);
| ^~~~~~
include/linux/dev_printk.h:146:70: note: expanded from macro 'dev_warn'
146 | dev_printk_index_wrap(_dev_warn, KERN_WARNING, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/dev_printk.h:110:23: note: expanded from macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ~~~ ^~~~~~~~~~~
2 warnings generated.
vim +673 drivers/cxl/core/pci.c
611
612 /**
613 * read_cdat_data - Read the CDAT data on this port
614 * @port: Port to read data from
615 *
616 * This call will sleep waiting for responses from the DOE mailbox.
617 */
618 void read_cdat_data(struct cxl_port *port)
619 {
620 struct device *uport = port->uport_dev;
621 struct device *dev = &port->dev;
622 struct pci_doe_mb *doe_mb;
623 struct pci_dev *pdev = NULL;
624 struct cxl_memdev *cxlmd;
625 struct cdat_doe_rsp *buf;
626 size_t table_length, length;
627 int rc;
628
629 if (is_cxl_memdev(uport)) {
630 struct device *host;
631
632 cxlmd = to_cxl_memdev(uport);
633 host = cxlmd->dev.parent;
634 if (dev_is_pci(host))
635 pdev = to_pci_dev(host);
636 } else if (dev_is_pci(uport)) {
637 pdev = to_pci_dev(uport);
638 }
639
640 if (!pdev)
641 return;
642
643 doe_mb = pci_find_doe_mailbox(pdev, PCI_DVSEC_VENDOR_ID_CXL,
644 CXL_DOE_PROTOCOL_TABLE_ACCESS);
645 if (!doe_mb) {
646 dev_dbg(dev, "No CDAT mailbox\n");
647 return;
648 }
649
650 port->cdat_available = true;
651
652 if (cxl_cdat_get_length(dev, doe_mb, &length)) {
653 dev_dbg(dev, "No CDAT length\n");
654 return;
655 }
656
657 /*
658 * The begin of the CDAT buffer needs space for additional 4
659 * bytes for the DOE header. Table data starts afterwards.
660 */
661 buf = devm_kzalloc(dev, sizeof(*buf) + length, GFP_KERNEL);
662 if (!buf)
663 goto err;
664
665 table_length = length;
666
667 rc = cxl_cdat_read_table(dev, doe_mb, buf, &length);
668 if (rc)
669 goto err;
670
671 if (table_length != length)
672 dev_warn(dev, "Malformed CDAT table length (%lu:%lu), discarding trailing data\n",
> 673 table_length, length);
674
675 if (cdat_checksum(buf->data, length))
676 goto err;
677
678 port->cdat.table = buf->data;
679 port->cdat.length = length;
680
681 return;
682 err:
683 /* Don't leave table data allocated on error */
684 devm_kfree(dev, buf);
685 dev_err(dev, "Failed to read/validate CDAT.\n");
686 }
687 EXPORT_SYMBOL_NS_GPL(read_cdat_data, CXL);
688
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 10+ messages in thread