linux-kernel - Re: [PATCH] x86/efi: Always map boot service regions into new EFI page tables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <alpine.DEB.2.10.1603151723560.2531@hadrien>
Date:	Tue, 15 Mar 2016 17:25:25 +0100 (CET)
From:	Julia Lawall <julia.lawall@...6.fr>
To:	Matt Fleming <matt@...eblueprint.co.uk>
cc:	Ingo Molnar <mingo@...nel.org>,
	Scott Ashcroft <scott.ashcroft@...k21.com>,
	"H . Peter Anvin" <hpa@...or.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	linux-kernel@...r.kernel.org, linux-efi@...r.kernel.org,
	Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
	Matthew Garrett <mjg59@...f.ucam.org>,
	Borislav Petkov <bp@...en8.de>,
	Ben Hutchings <ben@...adent.org.uk>,
	Raphael Hertzog <hertzog@...ian.org>,
	Roger Shimizu <rogershimizu@...il.com>,
	Alexis Murzeau <amurzeau@...il.com>,
	Julia Lawall <julia.lawall@...6.fr>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Josh Poimboeuf <jpoimboe@...hat.com>,
	Fengguang Wu <fengguang.wu@...el.com>
Subject: Re: [PATCH] x86/efi: Always map boot service regions into new EFI
 page tables



On Tue, 15 Mar 2016, Matt Fleming wrote:

> On Mon, 14 Mar, at 05:47:00PM, Ingo Molnar wrote:
> >
> > * Matt Fleming <matt@...eblueprint.co.uk> wrote:
> >
> > > Running the attached semantic patch across arch/x86/mm yields a few
> > > more places where we get the data type wrong for PAE,
> >
> > Very nice!
> >
> > > * file: arch/x86/mm/mmap.c:43 shifting int '( ( - 1UL ) & STACK_RND_MASK )' by PAGE_SHIFT is truncated to 32-bits
> > > * file: arch/x86/mm/pageattr-test.c:57 shifting long 'i' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr-test.c:138 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/gup.c:422 shifting int 'nr' by PAGE_SHIFT is truncated to 32-bits
> > > * file: arch/x86/mm/gup.c:303 shifting unsigned long '( unsigned long ) nr_pages' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/gup.c:370 shifting unsigned long '( unsigned long ) nr_pages' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pat.c:751 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr-test.c:57 shifting long 'i' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr.c:947 shifting unsigned 'num_pages' by PAGE_SHIFT is truncated to 32-bits
> > > * file: arch/x86/mm/pageattr.c:1995 shifting unsigned 'numpages' by PAGE_SHIFT is truncated to 32-bits
> > > * file: arch/x86/mm/pageattr-test.c:138 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr.c:1117 shifting unsigned long 'cpa -> numpages' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr.c:1017 shifting unsigned long 'cpa -> numpages' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr.c:1277 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr.c:1318 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr.c:986 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/pageattr.c:1059 shifting unsigned long 'cpa -> pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:197 shifting unsigned long 'end_pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:100 shifting unsigned long 'min_pfn_mapped' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:641 shifting unsigned long 'pagenr' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:111 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:121 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:111 shifting unsigned long __initdata 'pgt_buf_end' by PAGE_SHIFT is truncated to 32-bits
> > > * file: arch/x86/mm/init.c:196 shifting unsigned long 'start_pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:91 shifting unsigned long '( unsigned long ) num' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init.c:117 shifting unsigned long '( pfn + i )' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init_32.c:293 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init_32.c:301 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init_32.c:344 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init_32.c:361 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > > * file: arch/x86/mm/init_32.c:471 shifting unsigned long 'pfn' by PAGE_SHIFT is truncated to 32-bits for PAE
> > >
> > > The coccinelle script isn't perfect, and there are a number of false
> > > positives. For example, the first hit is bogus and looks like a
> > > coccinelle bug, but the results do show some things that need to be
> > > investigated.
> >
> > So I checked a few random examples in your list, and the false positive rate looks
> > rather low.
> >
> > The current Kbuild integration of Cocci scripts is pretty user-hostile. I'd love
> > to make this Cocci check part of the regular build process in some fashion (if a
> > Kconfig option is enabled), similarly to how we run objtool for example. We could
> > emit the Cocci warnings as a regular compiler 'warning: ' message, so people will
> > notice them as part of the build?
>
> For this type of cocci script where architecture knowledge of bug
> idioms is required (you need to know shifting by "PAGE_SHIFT" is
> usually done to build an address or size of some kind) I think the
> first step would be to automatically lookup scripts to be run on a
> per-directory basis.
>
> For example, running make(1) in arch/x86/kernel should map to
> scripts/coccinelle/arch/x86/kernel, etc.

Considering the current organization of make coccicheck, I think it would
be easier for Coccinelle to just abort on files not in the desired
directories.  This is possible to encode, although perhaps a little bit
awkward.

julia


> And yes, I agree, turning this on via a CONFIG_* symbol would be nice.
>
> > The false positive(s) could either be worked around or annotated away.
> >
> > Obviously we'd only use Cocci scripts that are known to be reliable.
>
> Fengguang, do you run coccinelle scripts currently as part of the
> 0-day lkp build machinery?
>