# git rev-parse -q --verify 8c1684bb81f173543599f1848c29a2a3b1ee5907^{commit} 8c1684bb81f173543599f1848c29a2a3b1ee5907 already have revision, skipping fetch # git checkout -q -f -B kisskb 8c1684bb81f173543599f1848c29a2a3b1ee5907 # git clean -qxdf # < git log -1 # commit 8c1684bb81f173543599f1848c29a2a3b1ee5907 # Merge: f44d5c489051 3f2c788a1314 # Author: Linus Torvalds # Date: Thu May 14 11:52:28 2020 -0700 # # Merge tag 'for-linus-2020-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux # # Pull thread fix from Christian Brauner: # "This contains a single fix for all exported legacy fork helpers to # block accidental access to clone3() features in the upper 32 bits of # their respective flags arguments. # # I got Cced on a glibc issue where someone reported consistent failures # for the legacy clone() syscall on ppc64le when sign extension was # performed (since the clone() syscall in glibc exposes the flags # argument as an int whereas the kernel uses unsigned long). # # The legacy clone() syscall is odd in a bunch of ways and here two # things interact: # # - First, legacy clone's flag argument is word-size dependent, i.e. # it's an unsigned long whereas most system calls with flag arguments # use int or unsigned int. # # - Second, legacy clone() ignores unknown and deprecated flags. # # The two of them taken together means that users on 64bit systems can # pass garbage for the upper 32bit of the clone() syscall since forever # and things would just work fine. # # The following program compiled on a 64bit kernel prior to v5.7-rc1 # will succeed and will fail post v5.7-rc1 with EBADF: # # int main(int argc, char *argv[]) # { # pid_t pid; # # /* Note that legacy clone() has different argument ordering on # * different architectures so this won't work everywhere. # * # * Only set the upper 32 bits. # */ # pid = syscall(__NR_clone, 0xffffffff00000000 | SIGCHLD, # NULL, NULL, NULL, NULL); # if (pid < 0) # exit(EXIT_FAILURE); # if (pid == 0) # exit(EXIT_SUCCESS); # if (wait(NULL) != pid) # exit(EXIT_FAILURE); # # exit(EXIT_SUCCESS); # } # # Since legacy clone() couldn't be extended this was not a problem so # far and nobody really noticed or cared since nothing in the kernel # ever bothered to look at the upper 32 bits. # # But once we introduced clone3() and expanded the flag argument in # struct clone_args to 64 bit we opened this can of worms. With the # first flag-based extension to clone3() making use of the upper 32 bits # of the flag argument we've effectively made it possible for the legacy # clone() syscall to reach clone3() only flags on accident. The sign # extension scenario is just the odd corner-case that we needed to # figure this out. # # The reason we just realized this now and not already when we # introduced CLONE_CLEAR_SIGHAND was that CLONE_INTO_CGROUP assumes that # a valid cgroup file descriptor has been given - whereas # CLONE_CLEAR_SIGHAND doesn't need to verify anything. It just silently # resets the signal handlers to SIG_DFL. # # So the sign extension (or the user accidently passing garbage for the # upper 32 bits) caused the CLONE_INTO_CGROUP bit to be raised and the # kernel to error out when it didn't find a valid cgroup file # descriptor. # # Note, I'm also capping kernel_thread()'s flag argument mainly because # none of the new features make sense for kernel_thread() and we # shouldn't risk them being accidently activated however unlikely. If we # wanted to, we could even make kernel_thread() yell when an unknown # flag has been set which it doesn't do right now. But it's not worth # risking this in a bugfix imho" # # * tag 'for-linus-2020-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/brauner/linux: # fork: prevent accidental access to clone3 features # < /opt/cross/kisskb/korg/gcc-10.1.0-nolibc/sh4-linux/bin/sh4-linux-gcc --version # < /opt/cross/kisskb/korg/gcc-10.1.0-nolibc/sh4-linux/bin/sh4-linux-ld --version # < git log --format=%s --max-count=1 8c1684bb81f173543599f1848c29a2a3b1ee5907 # < make -s -j 24 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc10 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-10.1.0-nolibc/sh4-linux/bin/sh4-linux- se7619_defconfig # < make -s -j 24 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc10 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-10.1.0-nolibc/sh4-linux/bin/sh4-linux- help # make -s -j 24 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc10 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-10.1.0-nolibc/sh4-linux/bin/sh4-linux- olddefconfig # make -s -j 24 ARCH=sh O=/kisskb/build/linus_se7619_defconfig_sh4-gcc10 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-10.1.0-nolibc/sh4-linux/bin/sh4-linux- Generating include/generated/machtypes.h :1511:2: warning: #warning syscall clone3 not implemented [-Wcpp] /kisskb/src/arch/sh/kernel/cpu/sh2/../../entry-common.S: Assembler messages: /kisskb/src/arch/sh/kernel/cpu/sh2/../../entry-common.S:385: Warning: overflow in branch to syscall_exit_work; converted into longer instruction sequence /kisskb/src/arch/sh/kernel/cpu/sh2/../../entry-common.S:388: Warning: overflow in branch to syscall_exit_work; converted into longer instruction sequence In file included from /kisskb/src/arch/sh/include/asm/hw_irq.h:6, from /kisskb/src/include/linux/irq.h:563, from /kisskb/src/arch/sh/include/asm/hardirq.h:6, from /kisskb/src/include/linux/hardirq.h:9, from /kisskb/src/include/linux/interrupt.h:11, from /kisskb/src/include/linux/serial_core.h:13, from /kisskb/src/include/linux/serial_sci.h:6, from /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:11: /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:105:24: note: in expansion of macro '_INTC_ARRAY' 105 | _INTC_ARRAY(vectors), _INTC_ARRAY(groups), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:8: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:106:2: note: in expansion of macro '_INTC_ARRAY' 106 | _INTC_ARRAY(mask_regs), _INTC_ARRAY(prio_regs), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:8: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:107:2: note: in expansion of macro '_INTC_ARRAY' 107 | _INTC_ARRAY(sense_regs), _INTC_ARRAY(ack_regs), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:8: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:100:63: warning: division 'sizeof (void *) / sizeof (void)' does not compute the number of array elements [-Wsizeof-pointer-div] 100 | #define _INTC_ARRAY(a) a, __same_type(a, NULL) ? 0 : sizeof(a)/sizeof(*a) | ^ /kisskb/src/include/linux/sh_intc.h:107:27: note: in expansion of macro '_INTC_ARRAY' 107 | _INTC_ARRAY(sense_regs), _INTC_ARRAY(ack_regs), \ | ^~~~~~~~~~~ /kisskb/src/include/linux/sh_intc.h:124:8: note: in expansion of macro 'INTC_HW_DESC' 124 | .hw = INTC_HW_DESC(vectors, groups, mask_regs, \ | ^~~~~~~~~~~~ /kisskb/src/arch/sh/kernel/cpu/sh2/setup-sh7619.c:58:8: note: in expansion of macro 'DECLARE_INTC_DESC' 58 | static DECLARE_INTC_DESC(intc_desc, "sh7619", vectors, NULL, | ^~~~~~~~~~~~~~~~~ /kisskb/src/drivers/sh/clk/cpg.c: In function 'r8': /kisskb/src/drivers/sh/clk/cpg.c:41:17: warning: passing argument 1 of 'ioread8' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 41 | return ioread8(addr); | ^~~~ In file included from /kisskb/src/arch/sh/include/asm/io.h:21, from /kisskb/src/include/linux/io.h:13, from /kisskb/src/drivers/sh/clk/cpg.c:14: /kisskb/src/include/asm-generic/iomap.h:29:29: note: expected 'void *' but argument is of type 'const void *' 29 | extern unsigned int ioread8(void __iomem *); | ^~~~~~~~~~~~~~ /kisskb/src/drivers/sh/clk/cpg.c: In function 'r16': /kisskb/src/drivers/sh/clk/cpg.c:46:18: warning: passing argument 1 of 'ioread16' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 46 | return ioread16(addr); | ^~~~ In file included from /kisskb/src/arch/sh/include/asm/io.h:21, from /kisskb/src/include/linux/io.h:13, from /kisskb/src/drivers/sh/clk/cpg.c:14: /kisskb/src/include/asm-generic/iomap.h:30:30: note: expected 'void *' but argument is of type 'const void *' 30 | extern unsigned int ioread16(void __iomem *); | ^~~~~~~~~~~~~~ /kisskb/src/drivers/sh/clk/cpg.c: In function 'r32': /kisskb/src/drivers/sh/clk/cpg.c:51:18: warning: passing argument 1 of 'ioread32' discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers] 51 | return ioread32(addr); | ^~~~ In file included from /kisskb/src/arch/sh/include/asm/io.h:21, from /kisskb/src/include/linux/io.h:13, from /kisskb/src/drivers/sh/clk/cpg.c:14: /kisskb/src/include/asm-generic/iomap.h:32:30: note: expected 'void *' but argument is of type 'const void *' 32 | extern unsigned int ioread32(void __iomem *); | ^~~~~~~~~~~~~~ Completed OK # rm -rf /kisskb/build/linus_se7619_defconfig_sh4-gcc10 # Build took: 0:00:32.890959