Re: [PATCH v11 09/14] kernel, arm64: untag user pointers in prctl_set_mm* - Linux-kselftest-mirror

18 Mar 2019


      On Sat, Mar 16, 2019 at 8:32 PM kbuild test robot lkp@intel.com wrote:
...
Hi Andrey,
Thank you for the patch! Yet something to improve:
[auto build test ERROR on linus/master]
[also build test ERROR on v5.0 next-20190306]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
url:    https://github.com/0day-ci/linux/commits/Andrey-Konovalov/uaccess-add-untagg...
config: x86_64-randconfig-x012-201911 (attached as .config)
compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64
All errors (new ones prefixed by >>):
kernel/sys.c: In function 'prctl_set_mm_map':
...
...
kernel/sys.c:1996:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
 prctl_map->start_code = untagged_addr(prctl_map.start_code);
          ^~

kernel/sys.c:1997:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->end_code = untagged_addr(prctl_map.end_code);
              ^~
   kernel/sys.c:1998:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->start_data = untagged_addr(prctl_map.start_data);
              ^~
   kernel/sys.c:1999:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->end_data = untagged_addr(prctl_map.end_data);
              ^~
   kernel/sys.c:2000:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->start_brk = untagged_addr(prctl_map.start_brk);
              ^~
   kernel/sys.c:2001:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->brk  = untagged_addr(prctl_map.brk);
              ^~
   kernel/sys.c:2002:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->start_stack = untagged_addr(prctl_map.start_stack);
              ^~
   kernel/sys.c:2003:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->arg_start = untagged_addr(prctl_map.arg_start);
              ^~
   kernel/sys.c:2004:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->arg_end = untagged_addr(prctl_map.arg_end);
              ^~
   kernel/sys.c:2005:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->env_start = untagged_addr(prctl_map.env_start);
              ^~
   kernel/sys.c:2006:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
     prctl_map->env_end = untagged_addr(prctl_map.env_end);
              ^~
vim +1996 kernel/sys.c
Right, I didn't have the related config options enabled when I did the
testing...
...
1974
  1975  #ifdef CONFIG_CHECKPOINT_RESTORE
  1976  static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data_size)
  1977  {
  1978          struct prctl_mm_map prctl_map = { .exe_fd = (u32)-1, };
  1979          unsigned long user_auxv[AT_VECTOR_SIZE];
  1980          struct mm_struct *mm = current->mm;
  1981          int error;
  1982
  1983          BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
  1984          BUILD_BUG_ON(sizeof(struct prctl_mm_map) > 256);
  1985
  1986          if (opt == PR_SET_MM_MAP_SIZE)
  1987                  return put_user((unsigned int)sizeof(prctl_map),
  1988                                  (unsigned int __user *)addr);
  1989
  1990          if (data_size != sizeof(prctl_map))
  1991                  return -EINVAL;
  1992
  1993          if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
  1994                  return -EFAULT;
  1995
...
1996          prctl_map->start_code   = untagged_addr(prctl_map.start_code);
1997          prctl_map->end_code     = untagged_addr(prctl_map.end_code);
  1998          prctl_map->start_data   = untagged_addr(prctl_map.start_data);
  1999          prctl_map->end_data     = untagged_addr(prctl_map.end_data);
  2000          prctl_map->start_brk    = untagged_addr(prctl_map.start_brk);
  2001          prctl_map->brk          = untagged_addr(prctl_map.brk);
  2002          prctl_map->start_stack  = untagged_addr(prctl_map.start_stack);
  2003          prctl_map->arg_start    = untagged_addr(prctl_map.arg_start);
  2004          prctl_map->arg_end      = untagged_addr(prctl_map.arg_end);
  2005          prctl_map->env_start    = untagged_addr(prctl_map.env_start);
  2006          prctl_map->env_end      = untagged_addr(prctl_map.env_end);
  2007
  2008          error = validate_prctl_map(&prctl_map);
  2009          if (error)
  2010                  return error;
  2011
  2012          if (prctl_map.auxv_size) {
  2013                  memset(user_auxv, 0, sizeof(user_auxv));
  2014                  if (copy_from_user(user_auxv,
  2015                                     (const void __user *)prctl_map.auxv,
  2016                                     prctl_map.auxv_size))
  2017                          return -EFAULT;
  2018
  2019                  /* Last entry must be AT_NULL as specification requires */
  2020                  user_auxv[AT_VECTOR_SIZE - 2] = AT_NULL;
  2021                  user_auxv[AT_VECTOR_SIZE - 1] = AT_NULL;
  2022          }
  2023
  2024          if (prctl_map.exe_fd != (u32)-1) {
  2025                  error = prctl_set_mm_exe_file(mm, prctl_map.exe_fd);
  2026                  if (error)
  2027                          return error;
  2028          }
  2029
  2030          /*
  2031           * arg_lock protects concurent updates but we still need mmap_sem for
  2032           * read to exclude races with sys_brk.
  2033           */
  2034          down_read(&mm->mmap_sem);
  2035
  2036          /*
  2037           * We don't validate if these members are pointing to
  2038           * real present VMAs because application may have correspond
  2039           * VMAs already unmapped and kernel uses these members for statistics
  2040           * output in procfs mostly, except
  2041           *
  2042           *  - @start_brk/@brk which are used in do_brk but kernel lookups
  2043           *    for VMAs when updating these memvers so anything wrong written
  2044           *    here cause kernel to swear at userspace program but won't lead
  2045           *    to any problem in kernel itself
  2046           */
  2047
  2048          spin_lock(&mm->arg_lock);
  2049          mm->start_code  = prctl_map.start_code;
  2050          mm->end_code    = prctl_map.end_code;
  2051          mm->start_data  = prctl_map.start_data;
  2052          mm->end_data    = prctl_map.end_data;
  2053          mm->start_brk   = prctl_map.start_brk;
  2054          mm->brk         = prctl_map.brk;
  2055          mm->start_stack = prctl_map.start_stack;
  2056          mm->arg_start   = prctl_map.arg_start;
  2057          mm->arg_end     = prctl_map.arg_end;
  2058          mm->env_start   = prctl_map.env_start;
  2059          mm->env_end     = prctl_map.env_end;
  2060          spin_unlock(&mm->arg_lock);
  2061
  2062          /*
  2063           * Note this update of @saved_auxv is lockless thus
  2064           * if someone reads this member in procfs while we're
  2065           * updating -- it may get partly updated results. It's
  2066           * known and acceptable trade off: we leave it as is to
  2067           * not introduce additional locks here making the kernel
  2068           * more complex.
  2069           */
  2070          if (prctl_map.auxv_size)
  2071                  memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv));
  2072
  2073          up_read(&mm->mmap_sem);
  2074          return 0;
  2075  }
  2076  #endif /* CONFIG_CHECKPOINT_RESTORE */
  2077

0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation