From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
To: kernel test robot <oliver.sang@intel.com>
Cc: oe-lkp@lists.linux.dev, lkp@intel.com,
linux-kernel@vger.kernel.org,
Luis Chamberlain <mcgrof@kernel.org>
Subject: Re: [PATCH v1 1/6] params: Use sysfs_emit() to instead of scnprintf()
Date: Thu, 21 Sep 2023 19:18:43 +0300 [thread overview]
Message-ID: <ZQxs445+AIBnSd8w@smile.fi.intel.com> (raw)
In-Reply-To: <ZQxjBkFZV5T6BELA@smile.fi.intel.com>
On Thu, Sep 21, 2023 at 06:36:38PM +0300, Andy Shevchenko wrote:
> On Thu, Sep 21, 2023 at 09:34:13PM +0800, kernel test robot wrote:
> >
> > Hello,
> >
> > kernel test robot noticed "WARNING:at_fs/sysfs/file.c:#sysfs_emit" on:
> >
> > commit: d4004295e5502a1eb3e361e97ea4dd1686046af6 ("[PATCH v1 1/6] params: Use sysfs_emit() to instead of scnprintf()")
> > url: https://github.com/intel-lab-lkp/linux/commits/Andy-Shevchenko/params-Introduce-the-param_unknown_fn-type/20230912-231033
> > base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git 0bb80ecc33a8fb5a682236443c1e740d5c917d1d
> > patch link: https://lore.kernel.org/all/20230912150551.401537-1-andriy.shevchenko@linux.intel.com/
> > patch subject: [PATCH v1 1/6] params: Use sysfs_emit() to instead of scnprintf()
> >
> > in testcase: trinity
> > version: trinity-i386-abe9de86-1_20230429
> > with following parameters:
> >
> > runtime: 300s
> > group: group-04
> > nr_groups: 5
>
>
> > what we observed is this issue doesn't always happen. we run the test upon
> > this commit almost 500 times, it happened 42 times.
> > however, the parent keeps clean.
> >
> > v6.6-rc1 d4004295e5502a1eb3e361e97ea
> > ---------------- ---------------------------
> > fail:runs %reproduction fail:runs
> > | | |
> > :497 8% 42:496 dmesg.EIP:sysfs_emit
> > :497 8% 42:496 dmesg.WARNING:at_fs/sysfs/file.c:#sysfs_emit
>
> Cool! I will check this, thank you for the report.
Oh, my gosh... This reveals a nice overflow bug for some getters that expect
buffer to be PAGE_SIZE, but an array can be bigger than that.
So, basically this is a flaw in param_array_get() which is a wrapper on top of
getter and calls ->get() without any proper alignment or buffer size guarantee!
While ->get() is by nature suppose to get an aligned buffer of PAGE_SIZE.
Ideally we need to have an additional ->get_array_element() callback which will
take an offset. Less intrusive one is to have an allocated buffer of PAGE_SIZE
in the param_array_get() and ->get() to it, then copy to the real one with the
offset. Any other proposals?
Luis, which solution would you prefer?
--
With Best Regards,
Andy Shevchenko
prev parent reply other threads:[~2023-09-21 17:28 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-09-12 15:05 [PATCH v1 1/6] params: Use sysfs_emit() to instead of scnprintf() Andy Shevchenko
2023-09-12 15:05 ` [PATCH v1 2/6] params: Introduce the param_unknown_fn type Andy Shevchenko
2023-09-12 15:05 ` [PATCH v1 3/6] params: Do not go over the limit when getting the string length Andy Shevchenko
2023-09-12 15:24 ` Andy Shevchenko
2023-09-12 15:05 ` [PATCH v1 4/6] params: Use size_add() for kmalloc() Andy Shevchenko
2023-09-12 15:05 ` [PATCH v1 5/6] params: Sort headers Andy Shevchenko
2023-09-12 15:05 ` [PATCH v1 6/6] params: Fix multi-line comment style Andy Shevchenko
2023-09-18 16:57 ` [PATCH v1 1/6] params: Use sysfs_emit() to instead of scnprintf() Andy Shevchenko
2023-09-21 0:32 ` Luis Chamberlain
2023-09-21 9:36 ` Andy Shevchenko
2023-09-21 13:34 ` kernel test robot
2023-09-21 15:36 ` Andy Shevchenko
2023-09-21 16:18 ` Andy Shevchenko [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZQxs445+AIBnSd8w@smile.fi.intel.com \
--to=andriy.shevchenko@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=mcgrof@kernel.org \
--cc=oe-lkp@lists.linux.dev \
--cc=oliver.sang@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox