# git rev-parse -q --verify d29dc5caf80d3cacbccb8f9c939f4c3a4f38d66b^{commit} # git fetch -q -n -f git://gitlab.ozlabs.ibm.com/linuxppc/linux.git fixes-test # git rev-parse -q --verify d29dc5caf80d3cacbccb8f9c939f4c3a4f38d66b^{commit} d29dc5caf80d3cacbccb8f9c939f4c3a4f38d66b # git checkout -q -f -B kisskb d29dc5caf80d3cacbccb8f9c939f4c3a4f38d66b # git clean -qxdf # < git log -1 # commit d29dc5caf80d3cacbccb8f9c939f4c3a4f38d66b # Author: Michael Ellerman # Date: Fri Feb 1 22:03:58 2019 +1100 # # powerpc/64: Fix memcmp reading past the end of src/dest # # Chandan reported that fstests' generic/026 test hit a crash: # # BUG: Unable to handle kernel data access at 0xc00000062ac40000 # Faulting instruction address: 0xc000000000092240 # Oops: Kernel access of bad area, sig: 11 [#1] # LE SMP NR_CPUS=2048 DEBUG_PAGEALLOC NUMA pSeries # CPU: 0 PID: 27828 Comm: chacl Not tainted 5.0.0-rc2-next-20190115-00001-g6de6dba64dda #1 # NIP: c000000000092240 LR: c00000000066a55c CTR: 0000000000000000 # REGS: c00000062c0c3430 TRAP: 0300 Not tainted (5.0.0-rc2-next-20190115-00001-g6de6dba64dda) # MSR: 8000000002009033 CR: 44000842 XER: 20000000 # CFAR: 00007fff7f3108ac DAR: c00000062ac40000 DSISR: 40000000 IRQMASK: 0 # GPR00: 0000000000000000 c00000062c0c36c0 c0000000017f4c00 c00000000121a660 # GPR04: c00000062ac3fff9 0000000000000004 0000000000000020 00000000275b19c4 # GPR08: 000000000000000c 46494c4500000000 5347495f41434c5f c0000000026073a0 # GPR12: 0000000000000000 c0000000027a0000 0000000000000000 0000000000000000 # GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 # GPR20: c00000062ea70020 c00000062c0c38d0 0000000000000002 0000000000000002 # GPR24: c00000062ac3ffe8 00000000275b19c4 0000000000000001 c00000062ac30000 # GPR28: c00000062c0c38d0 c00000062ac30050 c00000062ac30058 0000000000000000 # NIP memcmp+0x120/0x690 # LR xfs_attr3_leaf_lookup_int+0x53c/0x5b0 # Call Trace: # xfs_attr3_leaf_lookup_int+0x78/0x5b0 (unreliable) # xfs_da3_node_lookup_int+0x32c/0x5a0 # xfs_attr_node_addname+0x170/0x6b0 # xfs_attr_set+0x2ac/0x340 # __xfs_set_acl+0xf0/0x230 # xfs_set_acl+0xd0/0x160 # set_posix_acl+0xc0/0x130 # posix_acl_xattr_set+0x68/0x110 # __vfs_setxattr+0xa4/0x110 # __vfs_setxattr_noperm+0xac/0x240 # vfs_setxattr+0x128/0x130 # setxattr+0x248/0x600 # path_setxattr+0x108/0x120 # sys_setxattr+0x28/0x40 # system_call+0x5c/0x70 # Instruction dump: # 7d201c28 7d402428 7c295040 38630008 38840008 408201f0 4200ffe8 2c050000 # 4182ff6c 20c50008 54c61838 7d201c28 <7d402428> 7d293436 7d4a3436 7c295040 # # The instruction dump decodes as: # subfic r6,r5,8 # rlwinm r6,r6,3,0,28 # ldbrx r9,0,r3 # ldbrx r10,0,r4 <- # # Which shows us doing an 8 byte load from c00000062ac3fff9, which # crosses the page boundary at c00000062ac40000 and faults. # # It's not OK for memcmp to read past the end of the source or # destination buffers. # # The bug is in the code at the .Lcmp_rest_lt8bytes label. To fix it # test if we have at least 4 bytes to compare and if so do a 4 byte load # and compare. Otherwise, and/or if we have anything left, jump to the # existing code that does byte at a time comparison. # # Reported-by: Chandan Rajendra # Tested-by: Chandan Rajendra # Signed-off-by: Michael Ellerman # --- # # v2: Use cmpdi not cmpwi, it's a 64-bit reg even if we "know" the value # is less than 8. # < /opt/cross/kisskb/gcc-4.6.3-nolibc/sh4-linux/bin/sh4-linux-gcc --version # < /opt/cross/kisskb/gcc-4.6.3-nolibc/sh4-linux/bin/sh4-linux-ld --version # < git log --format=%s --max-count=1 d29dc5caf80d3cacbccb8f9c939f4c3a4f38d66b # < make -s -j 48 ARCH=sh O=/kisskb/build/powerpc-fixes_sh-defconfig_sh4 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/sh4-linux/bin/sh4-linux- defconfig # make -s -j 48 ARCH=sh O=/kisskb/build/powerpc-fixes_sh-defconfig_sh4 CROSS_COMPILE=/opt/cross/kisskb/gcc-4.6.3-nolibc/sh4-linux/bin/sh4-linux- Generating include/generated/machtypes.h :1318:2: warning: #warning syscall pkey_mprotect not implemented [-Wcpp] :1321:2: warning: #warning syscall pkey_alloc not implemented [-Wcpp] :1324:2: warning: #warning syscall pkey_free not implemented [-Wcpp] :1327:2: warning: #warning syscall statx not implemented [-Wcpp] :1333:2: warning: #warning syscall io_pgetevents not implemented [-Wcpp] :1336:2: warning: #warning syscall rseq not implemented [-Wcpp] /kisskb/src/arch/sh/kernel/cpu/sh4/../sh3/../../entry-common.S: Assembler messages: /kisskb/src/arch/sh/kernel/cpu/sh4/../sh3/../../entry-common.S:385: Warning: overflow in branch to syscall_exit_work; converted into longer instruction sequence /kisskb/src/arch/sh/kernel/cpu/sh4/../sh3/../../entry-common.S:388: Warning: overflow in branch to syscall_exit_work; converted into longer instruction sequence /kisskb/src/fs/proc/inode.c: In function 'proc_reg_open': /kisskb/src/include/linux/list.h:65:12: warning: 'pdeo' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/proc/inode.c:339:21: note: 'pdeo' was declared here /kisskb/src/kernel/printk/printk.c: In function 'devkmsg_sysctl_set_loglvl': /kisskb/src/kernel/printk/printk.c:186:16: warning: 'old' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/cgroup/cgroup-v1.c: In function 'cgroup1_mount': /kisskb/src/kernel/cgroup/cgroup-v1.c:1263:20: warning: 'root' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/rcu/srcutree.c: In function 'init_srcu_struct_fields': /kisskb/src/kernel/rcu/srcutree.c:152:32: warning: 'levelspread[]' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/kernel/rcu/srcutree.c:100:6: note: 'levelspread[]' was declared here /kisskb/src/drivers/base/regmap/regmap.c: In function 'regmap_raw_read': /kisskb/src/drivers/base/regmap/regmap.c:2594:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/base/regmap/regmap.c: In function '_regmap_raw_write': /kisskb/src/drivers/base/regmap/regmap.c:1855:6: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/ext4/readpage.c: In function 'ext4_mpage_readpages': /kisskb/src/fs/ext4/readpage.c:295:1: warning: the frame size of 1200 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/kernel/trace/trace_dynevent.c: In function 'create_dyn_event': /kisskb/src/kernel/trace/trace_dynevent.c:89:5: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/fs/mpage.c: In function 'do_mpage_readpage': /kisskb/src/fs/mpage.c:338:1: warning: the frame size of 1108 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/fs/mpage.c: In function '__mpage_writepage': /kisskb/src/fs/mpage.c:690:1: warning: the frame size of 1148 bytes is larger than 1024 bytes [-Wframe-larger-than=] /kisskb/src/mm/vmstat.c: In function 'sysctl_vm_numa_stat_handler': /kisskb/src/mm/vmstat.c:89:5: warning: 'oldval' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/ipv4/ip_output.c: In function '__ip_append_data': /kisskb/src/include/linux/skbuff.h:1338:6: warning: 'extra_uref' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/ipv4/ip_output.c:885:14: note: 'extra_uref' was declared here /kisskb/src/drivers/i2c/i2c-core-base.c: In function 'i2c_generic_scl_recovery': /kisskb/src/drivers/i2c/i2c-core-base.c:235:5: warning: 'ret' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/drivers/sh/clk/cpg.c: In function 'r8': /kisskb/src/drivers/sh/clk/cpg.c:41:2: warning: passing argument 1 of 'ioread8' discards 'const' qualifier from pointer target type [enabled by default] /kisskb/src/include/asm-generic/iomap.h:29:21: note: expected 'void *' but argument is of type 'const void *' /kisskb/src/drivers/sh/clk/cpg.c: In function 'r16': /kisskb/src/drivers/sh/clk/cpg.c:46:2: warning: passing argument 1 of 'ioread16' discards 'const' qualifier from pointer target type [enabled by default] /kisskb/src/include/asm-generic/iomap.h:30:21: note: expected 'void *' but argument is of type 'const void *' /kisskb/src/drivers/sh/clk/cpg.c: In function 'r32': /kisskb/src/drivers/sh/clk/cpg.c:51:2: warning: passing argument 1 of 'ioread32' discards 'const' qualifier from pointer target type [enabled by default] /kisskb/src/include/asm-generic/iomap.h:32:21: note: expected 'void *' but argument is of type 'const void *' /kisskb/src/mm/hugetlb.c: In function 'alloc_pool_huge_page': /kisskb/src/mm/hugetlb.c:1434:5: warning: 'page' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/ipv6/ip6_output.c: In function '__ip6_append_data.isra.12': /kisskb/src/include/linux/skbuff.h:1338:6: warning: 'extra_uref' may be used uninitialized in this function [-Wuninitialized] /kisskb/src/net/ipv6/ip6_output.c:1270:14: note: 'extra_uref' was declared here Kernel: arch/sh/boot/zImage is ready Completed OK # rm -rf /kisskb/build/powerpc-fixes_sh-defconfig_sh4 # Build took: 0:03:02.832510