From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4092BC43334 for ; Thu, 2 Jun 2022 11:21:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234099AbiFBLU6 (ORCPT ); Thu, 2 Jun 2022 07:20:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41820 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231266AbiFBLUz (ORCPT ); Thu, 2 Jun 2022 07:20:55 -0400 Received: from mail-yb1-xb2d.google.com (mail-yb1-xb2d.google.com [IPv6:2607:f8b0:4864:20::b2d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54F792A80FE for ; Thu, 2 Jun 2022 04:20:53 -0700 (PDT) Received: by mail-yb1-xb2d.google.com with SMTP id a64so7705168ybg.11 for ; Thu, 02 Jun 2022 04:20:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=6r6Vaw+wZvpxvKWw2pORFiU+DbCU4N7wdhOQeTbklfc=; b=m0OEpK597X7Jm59IE3NiU7ra1ljGWT0v9rqyVt5WF+xQOU8MX3XqOxTO6lWuU168Nb KxAHL5oIcH5PH/Gzsck3NoHWIY20v/090PzZzAOHKR/Q7sLMTPk4CAIApvN8p6TFUYEY B6ilnZQslx3vho5a8lpxJP2cT72tTfzsQINEA8OEEkBIravpJHh0rtCsH6mbhoe9bE75 vWWTVU5S0rMTNNv1kFizVCJn3Xi5fCuyO+quUQubNBerWcS4Rq7dz4/eZEydDOylA11O t6fiOh8MrUCSJOTqc87gmkjxh0W91Et7HG+v/nZJqCjF3hMiaqITAmaUYZR8VnyCg8gM 3Ang== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=6r6Vaw+wZvpxvKWw2pORFiU+DbCU4N7wdhOQeTbklfc=; b=J4fKxxQ18rl2BEjp2r2zJisgP16MeMn/0wqIWuIabu9AsAEqilvcXdM3GXzeFLlC+7 hmN7ITwAyWcCdCurOJdmmmlvTi58kznZU7BC5g6Rcllvl4ujvc/BgVs80XYFJ9GZUm+D Sh7ReZuv6pc1nJLh/LmqMGT6mbRNJWh67o/tkpTCI8GGKjO2/72r6DtPpcfI0n9YTvE2 NpKucElutDRTblr0VN5f1jNxnUXMfMbGOJbuBk3ZKJzXEK+8tYUZHbJgSd/GvXRA+1QO k01Gsq2YzgIib325viOl6VpKHrSVguWThUobldZZkEb/jlvB87RmMhGUw6dQ2D2/zZ1T DHGg== X-Gm-Message-State: AOAM532vnpBPVb5wfeQLPF+zCLsQ79HDfquySDo1h0uIK16NTAXBn6dN mw3l7wBqXsi/u28Krp54UoE0jzyKC3cjcUi6f54YOA== X-Google-Smtp-Source: ABdhPJxI8RjbLjO2b9SZDaxy2qFIb8juG6DprYWcrXQV0N+mLi1jIj6L/wKi/ae5MVHdUK1h3xajcbA/Z66IiOGwWWo= X-Received: by 2002:a5b:4c7:0:b0:65d:313:6270 with SMTP id u7-20020a5b04c7000000b0065d03136270mr4614359ybp.363.1654168852326; Thu, 02 Jun 2022 04:20:52 -0700 (PDT) MIME-Version: 1.0 References: <20220426164315.625149-1-glider@google.com> <20220426164315.625149-6-glider@google.com> In-Reply-To: From: Alexander Potapenko Date: Thu, 2 Jun 2022 13:20:16 +0200 Message-ID: Subject: Re: [PATCH v3 05/46] x86: asm: instrument usercopy in get_user() and __put_user_size() To: Arnd Bergmann Cc: Alexander Viro , Andrew Morton , Andrey Konovalov , Andy Lutomirski , Borislav Petkov , Christoph Hellwig , Christoph Lameter , David Rientjes , Dmitry Vyukov , Eric Dumazet , Greg Kroah-Hartman , Herbert Xu , Ilya Leoshkevich , Ingo Molnar , Jens Axboe , Joonsoo Kim , Kees Cook , Marco Elver , Mark Rutland , Matthew Wilcox , "Michael S. Tsirkin" , Pekka Enberg , Peter Zijlstra , Petr Mladek , Steven Rostedt , Thomas Gleixner , Vasily Gorbik , Vegard Nossum , Vlastimil Babka , kasan-dev , Linux-MM , linux-arch , Linux Kernel Mailing List Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Apr 27, 2022 at 9:15 AM Arnd Bergmann wrote: > > On Tue, Apr 26, 2022 at 6:42 PM Alexander Potapenko w= rote: > > @@ -99,11 +100,13 @@ extern int __get_user_bad(void); > > int __ret_gu; = \ > > register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX); = \ > > __chk_user_ptr(ptr); = \ > > + instrument_copy_from_user_before((void *)&(x), ptr, sizeof(*(pt= r))); \ > > asm volatile("call __" #fn "_%P4" = \ > > : "=3Da" (__ret_gu), "=3Dr" (__val_gu), = \ > > ASM_CALL_CONSTRAINT = \ > > : "0" (ptr), "i" (sizeof(*(ptr)))); = \ > > (x) =3D (__force __typeof__(*(ptr))) __val_gu; = \ > > + instrument_copy_from_user_after((void *)&(x), ptr, sizeof(*(ptr= )), 0); \ > > Isn't "ptr" the original pointer here? I think what happened with the > reported warning is that you get one output line for every instance this > is used in. There should probably be a > > __auto_type __ptr =3D (ptr); > > at the beginning of the macro to ensure that 'ptr' is only evaluated once= . > > >>> arch/x86/kernel/signal.c:360:9: sparse: sparse: incorrect type in arg= ument 1 (different address spaces) @@ expected void [noderef] __user *t= o @@ got unsigned long long [usertype] * @@ > > It would also make sense to add the missing __user annotation in this lin= e, but > I suspect there are others like it in drivers. > > Arnd I ran sparse locally, and it is actually the missing __user annotations in signal.c that cause these reports. The following patch: diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c index e439eb14325fa..68537dbffa545 100644 --- a/arch/x86/kernel/signal.c +++ b/arch/x86/kernel/signal.c @@ -355,7 +355,7 @@ __setup_frame(int sig, struct ksignal *ksig, sigset_t *= set, * reasons and because gdb uses it as a signature to notice * signal handler stack frames. */ - unsafe_put_user(*((u64 *)&retcode), (u64 *)frame->retcode, Efault); + unsafe_put_user(*((u64 *)&retcode), (__user u64 *)frame->retcode, Efault); user_access_end(); /* Set up registers for signal handler */ @@ -415,7 +415,7 @@ static int __setup_rt_frame(int sig, struct ksignal *ks= ig, * reasons and because gdb uses it as a signature to notice * signal handler stack frames. */ - unsafe_put_user(*((u64 *)&rt_retcode), (u64 *)frame->retcode, Efaul= t); + unsafe_put_user(*((u64 *)&rt_retcode), (__user u64 *)frame->retcode, Efault); unsafe_put_sigcontext(&frame->uc.uc_mcontext, fp, regs, set, Efault= ); unsafe_put_sigmask(set, frame, Efault); user_access_end(); appears to fix sparse warnings. --=20 Alexander Potapenko Software Engineer Google Germany GmbH Erika-Mann-Stra=C3=9Fe, 33 80636 M=C3=BCnchen Gesch=C3=A4ftsf=C3=BChrer: Paul Manicle, Liana Sebastian Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg Diese E-Mail ist vertraulich. Falls Sie diese f=C3=A4lschlicherweise erhalten haben sollten, leiten Sie diese bitte nicht an jemand anderes weiter, l=C3=B6schen Sie alle Kopien und Anh=C3=A4nge davon und lassen Sie = mich bitte wissen, dass die E-Mail an die falsche Person gesendet wurde. This e-mail is confidential. If you received this communication by mistake, please don't forward it to anyone else, please erase all copies and attachments, and please let me know that it has gone to the wrong person.