linux-kernel - Re: [PATCH] x86/boot/compressed/64: fix warning for 32-bit trampoline copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAK8P3a2FaGfCYmMqD-1WPks+F-jpM-AzSFWLtYfp=BxgoFLTfA@mail.gmail.com>
Date:   Thu, 22 Feb 2018 12:24:25 +0100
From:   Arnd Bergmann <arnd@...db.de>
To:     "Kirill A. Shutemov" <kirill@...temov.name>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Martin Sebor <msebor@...il.com>,
        "H. Peter Anvin" <hpa@...or.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] x86/boot/compressed/64: fix warning for 32-bit trampoline copy

On Thu, Feb 22, 2018 at 12:02 PM, Kirill A. Shutemov
<kirill@...temov.name> wrote:
> On Thu, Feb 22, 2018 at 11:40:41AM +0100, Arnd Bergmann wrote:
>> gcc-8 warns that we copy TRAMPOLINE_32BIT_CODE_SIZE bytes from the pointer
>> to the function into actual trampoline, when that pointer is only 8 bytes:
>>
>> In file included from arch/x86/boot/compressed/pgtable_64.c:3:
>> arch/x86/boot/compressed/pgtable_64.c: In function 'paging_prepare':
>> arch/x86/boot/compressed/../string.h:18:23: error: '__builtin_memcpy' reading 96 bytes from a region of size 8 [-Werror=stringop-overflow=]
>>  #define memcpy(d,s,l) __builtin_memcpy(d,s,l)
>>                        ^~~~~~~~~~~~~~~~~~~~~~~
>> arch/x86/boot/compressed/pgtable_64.c:62:2: note: in expansion of macro 'memcpy'
>>   memcpy(trampoline + TRAMPOLINE_32BIT_CODE_OFFSET / sizeof(unsigned long),
>>   ^~~~~~
>>
>> I assume what was intended here is to copy the trampoline itself rather than
>> the pointer to the trampoline.
>>
>> Cc: Martin Sebor <msebor@...il.com>
>> Fixes: b91993a87aff ("x86/boot/compressed/64: Prepare trampoline memory")
>> Signed-off-by: Arnd Bergmann <arnd@...db.de>
>> ---
>> This is a fairly new warning in gcc, it's possible that the code is
>> correct and the warning message got it wrong, please double-check this.
>>
>> Was the 32-bit trampoline code in the 64-bit decompressor tested successfully?
>
> Yes, it was. Actually it tested on every boot of any 64-bit machine.
>
> The fix is wrong and it breaks boot. The bug is in trampoline_32bit_src
> declaration. Could you check if this helps with the warning:

Got it, yes that definitely explains the problem. Your patch fixes it
and I'll follow up with a new submission using this change, unless you
want to send it as a patch yourself.

       Arnd

> diff --git a/arch/x86/boot/compressed/pgtable.h b/arch/x86/boot/compressed/pgtable.h
> index 6e0db2260147..5e0b1c4abef4 100644
> --- a/arch/x86/boot/compressed/pgtable.h
> +++ b/arch/x86/boot/compressed/pgtable.h
> @@ -12,7 +12,7 @@
>
>  #ifndef __ASSEMBLER__
>
> -extern void (*trampoline_32bit_src)(void *return_ptr);
> +extern void trampoline_32bit_src(void *return_ptr);
>
>  #endif /* __ASSEMBLER__ */
>  #endif /* BOOT_COMPRESSED_PAGETABLE_H */
> --
>  Kirill A. Shutemov