From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14FCF16939E; Mon, 27 May 2024 15:54:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716825288; cv=none; b=EHu5gG3452DH7nYP7jXf+98LxXu/OsP1Mq72ARpR1rWGVM5QYOvjzsTmDOKQDhA1EwmYezf2S01TgTYuYAIp17pmDkQ0rnzxMsZeCftyq4HB76fD2+4a6DkohloMu6/n7JmLJm3/kgRy3qrKD/EGdqSK9enCnC9oNXgc6QSvlDU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1716825288; c=relaxed/simple; bh=3SmlgS7uzCZyp3qIvmlKEKCak6Qut8+f73ynLbkP9IM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MuD2TfHK2/XTzU19QopiyKxViwY6c3Ke0X7pP1A72JGAIG0x/nVUd8P24uxw8LPYRgvD67g1dFOz1XgyvfapwkeyNsYbhB/b/1zRBJQbAOIO1dUFW31EV/5cj/3KwfpuHBGQA3icHDZIdhsP2+4pW1uRGchC74IxWZT7jGh+fAo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MDInUzFr; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MDInUzFr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D481C2BBFC; Mon, 27 May 2024 15:54:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1716825287; bh=3SmlgS7uzCZyp3qIvmlKEKCak6Qut8+f73ynLbkP9IM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MDInUzFrUwj6r4nbuVXtBsxep0/2FwmUYmoTR8NcY8P9SMXvi4uLfxiUKjm+CttS1 HxPl8vJQPYslT7zEQapvVWk1uHg6L7ppAGkoJdMPNJUjPRnDQ8WMr2w/vACL4/LRZh CNVV1p34jbmNrRBqyV/6JTTXAkOqoe2AaO0taeK/k2fd+39hjM/BQk+xX+vRrc5SfA 4ikpc0Pvmk5wzdlhTIW87nf2uXBnOoxqwrq/hR3l+O2/NXQecRfd7fX8yZUMCFELs7 /pzQLiDGkiN7Gm2+Tmf1p9M4enQnFkmiQHH+YHymfe0IUq9vsstZInW2IX0ANGyLme wNna/dDgAILww== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Nathan Lynch , Michael Ellerman , Sasha Levin , nathan@kernel.org, vaibhav@linux.ibm.com, kconsul@linux.vnet.ibm.com, amachhiw@linux.vnet.ibm.com, sshegde@linux.ibm.com, jniethe5@gmail.com, linuxppc-dev@lists.ozlabs.org, llvm@lists.linux.dev Subject: [PATCH AUTOSEL 6.8 16/20] powerpc/pseries: Enforce hcall result buffer validity and size Date: Mon, 27 May 2024 11:52:59 -0400 Message-ID: <20240527155349.3864778-16-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240527155349.3864778-1-sashal@kernel.org> References: <20240527155349.3864778-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.8.11 Content-Transfer-Encoding: 8bit From: Nathan Lynch [ Upstream commit ff2e185cf73df480ec69675936c4ee75a445c3e4 ] plpar_hcall(), plpar_hcall9(), and related functions expect callers to provide valid result buffers of certain minimum size. Currently this is communicated only through comments in the code and the compiler has no idea. For example, if I write a bug like this: long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...); This compiles with no diagnostics emitted, but likely results in stack corruption at runtime when plpar_hcall9() stores results past the end of the array. (To be clear this is a contrived example and I have not found a real instance yet.) To make this class of error less likely, we can use explicitly-sized array parameters instead of pointers in the declarations for the hcall APIs. When compiled with -Warray-bounds[1], the code above now provokes a diagnostic like this: error: array argument is too small; is of size 32, callee requires at least 72 [-Werror,-Warray-bounds] 60 | plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, | ^ ~~~~~~ [1] Enabled for LLVM builds but not GCC for now. See commit 0da6e5fd6c37 ("gcc: disable '-Warray-bounds' for gcc-13 too") and related changes. Signed-off-by: Nathan Lynch Signed-off-by: Michael Ellerman Link: https://msgid.link/20240408-pseries-hvcall-retbuf-v1-1-ebc73d7253cf@linux.ibm.com Signed-off-by: Sasha Levin --- arch/powerpc/include/asm/hvcall.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h index a41e542ba94dd..39cd1ca4ccb9c 100644 --- a/arch/powerpc/include/asm/hvcall.h +++ b/arch/powerpc/include/asm/hvcall.h @@ -524,7 +524,7 @@ long plpar_hcall_norets_notrace(unsigned long opcode, ...); * Used for all but the craziest of phyp interfaces (see plpar_hcall9) */ #define PLPAR_HCALL_BUFSIZE 4 -long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); +long plpar_hcall(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); /** * plpar_hcall_raw: - Make a hypervisor call without calculating hcall stats @@ -538,7 +538,7 @@ long plpar_hcall(unsigned long opcode, unsigned long *retbuf, ...); * plpar_hcall, but plpar_hcall_raw works in real mode and does not * calculate hypervisor call statistics. */ -long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); +long plpar_hcall_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL_BUFSIZE], ...); /** * plpar_hcall9: - Make a pseries hypervisor call with up to 9 return arguments @@ -549,8 +549,8 @@ long plpar_hcall_raw(unsigned long opcode, unsigned long *retbuf, ...); * PLPAR_HCALL9_BUFSIZE to size the return argument buffer. */ #define PLPAR_HCALL9_BUFSIZE 9 -long plpar_hcall9(unsigned long opcode, unsigned long *retbuf, ...); -long plpar_hcall9_raw(unsigned long opcode, unsigned long *retbuf, ...); +long plpar_hcall9(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); +long plpar_hcall9_raw(unsigned long opcode, unsigned long retbuf[static PLPAR_HCALL9_BUFSIZE], ...); /* pseries hcall tracing */ extern struct static_key hcall_tracepoint_key; -- 2.43.0