[PATCH] asm/sections: fix memory object end check

[PATCH] asm/sections: fix memory object end check

[Alexander Gordeev]

Function memory_contains() checks whether a memory object is
entirely contained within a memory region. The condition that
checks the upper bound of the object against the upper bound
of the region is inclusive. That does not correspond to the
similar checks in memory_intersects() friend function, nor
to the actual regions memory_contains() is called against.

In particular, __init_end address assumed do not belong to
the init section itself. Similarly, on ARM __idmap_text_end
and __entry_text_end are affected.

Fixes: 979559362516 ("asm/sections: add helpers to check for section data")
Cc: Thierry Reding <treding@nvidia.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Russell King <linux@armlinux.org.uk>
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
---
 include/asm-generic/sections.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 1dfadb2e878d..23f325cd2c66 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -78,7 +78,7 @@ extern __visible const void __nosave_begin, __nosave_end;
 static inline bool memory_contains(void *begin, void *end, void *virt,
 				   size_t size)
 {
-	return virt >= begin && virt + size <= end;
+	return virt >= begin && virt + size < end;
 }
 
 /**
-- 
2.32.0

[PATCH] asm/sections: fix memory object end check

[Alexander Gordeev]

Function memory_contains() checks whether a memory object is
entirely contained within a memory region. The condition that
checks the upper bound of the object against the upper bound
of the region is inclusive. That does not correspond to the
similar checks in memory_intersects() friend function, nor
to the actual regions memory_contains() is called against.

In particular, __init_end address assumed do not belong to
the init section itself. Similarly, on ARM __idmap_text_end
and __entry_text_end are affected.

Fixes: 979559362516 ("asm/sections: add helpers to check for section data")
Cc: Thierry Reding <treding@nvidia.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Russell King <linux@armlinux.org.uk>
Cc: linux-arm-kernel@lists.infradead.org
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
---
 include/asm-generic/sections.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 1dfadb2e878d..23f325cd2c66 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -78,7 +78,7 @@ extern __visible const void __nosave_begin, __nosave_end;
 static inline bool memory_contains(void *begin, void *end, void *virt,
 				   size_t size)
 {
-	return virt >= begin && virt + size <= end;
+	return virt >= begin && virt + size < end;
 }
 
 /**
-- 
2.32.0


_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Re: [PATCH] asm/sections: fix memory object end check

[Russell King (Oracle)]

On Tue, Dec 21, 2021 at 08:06:24AM +0100, Alexander Gordeev wrote:
> Function memory_contains() checks whether a memory object is
> entirely contained within a memory region. The condition that
> checks the upper bound of the object against the upper bound
> of the region is inclusive. That does not correspond to the
> similar checks in memory_intersects() friend function, nor
> to the actual regions memory_contains() is called against.
> 
> In particular, __init_end address assumed do not belong to
> the init section itself. Similarly, on ARM __idmap_text_end
> and __entry_text_end are affected.

__init_end is exclusive as are the other symbols you mention here.
They point at the byte immediately following the area.

When testing an virt + size, the resulting address of "virt + size" is
always exclusive - this also points at the byte immediately following
the range of addresses. The preceeding byte is part of the object.

For example, if size is one, then we have a single byte, which is at
address "virt". "virt + 1" is not part of the object. Therefore, if
size is 1MiB, then "virt + 1048576" is similarly not part of the
object.

Hence, we _do_ want to test address + size <= end.

This code appears to me to be correct, and this patch _introduces_ a
bug.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

Re: [PATCH] asm/sections: fix memory object end check

[Russell King (Oracle)]

On Tue, Dec 21, 2021 at 08:06:24AM +0100, Alexander Gordeev wrote:
> Function memory_contains() checks whether a memory object is
> entirely contained within a memory region. The condition that
> checks the upper bound of the object against the upper bound
> of the region is inclusive. That does not correspond to the
> similar checks in memory_intersects() friend function, nor
> to the actual regions memory_contains() is called against.
> 
> In particular, __init_end address assumed do not belong to
> the init section itself. Similarly, on ARM __idmap_text_end
> and __entry_text_end are affected.

__init_end is exclusive as are the other symbols you mention here.
They point at the byte immediately following the area.

When testing an virt + size, the resulting address of "virt + size" is
always exclusive - this also points at the byte immediately following
the range of addresses. The preceeding byte is part of the object.

For example, if size is one, then we have a single byte, which is at
address "virt". "virt + 1" is not part of the object. Therefore, if
size is 1MiB, then "virt + 1048576" is similarly not part of the
object.

Hence, we _do_ want to test address + size <= end.

This code appears to me to be correct, and this patch _introduces_ a
bug.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel