lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 1 Jun 2019 09:16:41 -0400 From: Sasha Levin <sashal@...nel.org> To: linux-kernel@...r.kernel.org, stable@...r.kernel.org Cc: Arnd Bergmann <arnd@...db.de>, Masahiro Yamada <yamada.masahiro@...ionext.com>, Heiko Carstens <heiko.carstens@...ibm.com>, Ingo Molnar <mingo@...hat.com>, Christophe Leroy <christophe.leroy@....fr>, Mathieu Malaterre <malat@...ian.org>, "H. Peter Anvin" <hpa@...or.com>, Thomas Gleixner <tglx@...utronix.de>, Benjamin Herrenschmidt <benh@...nel.crashing.org>, Paul Mackerras <paulus@...ba.org>, Ralf Baechle <ralf@...ux-mips.org>, Stefan Agner <stefan@...er.ch>, Boris Brezillon <bbrezillon@...nel.org>, Miquel Raynal <miquel.raynal@...tlin.com>, Richard Weinberger <richard@....at>, David Woodhouse <dwmw2@...radead.org>, Brian Norris <computersforpeace@...il.com>, Marek Vasut <marek.vasut@...il.com>, Russell King <rmk+kernel@....linux.org.uk>, Borislav Petkov <bp@...e.de>, Mark Rutland <mark.rutland@....com>, Andrew Morton <akpm@...ux-foundation.org>, Linus Torvalds <torvalds@...ux-foundation.org>, Sasha Levin <sashal@...nel.org> Subject: [PATCH AUTOSEL 5.0 009/173] ARM: prevent tracing IPI_CPU_BACKTRACE From: Arnd Bergmann <arnd@...db.de> [ Upstream commit be167862ae7dd85c56d385209a4890678e1b0488 ] Patch series "compiler: allow all arches to enable CONFIG_OPTIMIZE_INLINING", v3. This patch (of 11): When function tracing for IPIs is enabled, we get a warning for an overflow of the ipi_types array with the IPI_CPU_BACKTRACE type as triggered by raise_nmi(): arch/arm/kernel/smp.c: In function 'raise_nmi': arch/arm/kernel/smp.c:489:2: error: array subscript is above array bounds [-Werror=array-bounds] trace_ipi_raise(target, ipi_types[ipinr]); This is a correct warning as we actually overflow the array here. This patch raise_nmi() to call __smp_cross_call() instead of smp_cross_call(), to avoid calling into ftrace. For clarification, I'm also adding a two new code comments describing how this one is special. The warning appears to have shown up after commit e7273ff49acf ("ARM: 8488/1: Make IPI_CPU_BACKTRACE a "non-secure" SGI"), which changed the number assignment from '15' to '8', but as far as I can tell has existed since the IPI tracepoints were first introduced. If we decide to backport this patch to stable kernels, we probably need to backport e7273ff49acf as well. [yamada.masahiro@...ionext.com: rebase on v5.1-rc1] Link: http://lkml.kernel.org/r/20190423034959.13525-2-yamada.masahiro@socionext.com Fixes: e7273ff49acf ("ARM: 8488/1: Make IPI_CPU_BACKTRACE a "non-secure" SGI") Fixes: 365ec7b17327 ("ARM: add IPI tracepoints") # v3.17 Signed-off-by: Arnd Bergmann <arnd@...db.de> Signed-off-by: Masahiro Yamada <yamada.masahiro@...ionext.com> Cc: Heiko Carstens <heiko.carstens@...ibm.com> Cc: Arnd Bergmann <arnd@...db.de> Cc: Ingo Molnar <mingo@...hat.com> Cc: Christophe Leroy <christophe.leroy@....fr> Cc: Mathieu Malaterre <malat@...ian.org> Cc: "H. Peter Anvin" <hpa@...or.com> Cc: Thomas Gleixner <tglx@...utronix.de> Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org> Cc: Paul Mackerras <paulus@...ba.org> Cc: Ralf Baechle <ralf@...ux-mips.org> Cc: Stefan Agner <stefan@...er.ch> Cc: Boris Brezillon <bbrezillon@...nel.org> Cc: Miquel Raynal <miquel.raynal@...tlin.com> Cc: Richard Weinberger <richard@....at> Cc: David Woodhouse <dwmw2@...radead.org> Cc: Brian Norris <computersforpeace@...il.com> Cc: Marek Vasut <marek.vasut@...il.com> Cc: Russell King <rmk+kernel@....linux.org.uk> Cc: Borislav Petkov <bp@...e.de> Cc: Mark Rutland <mark.rutland@....com> Signed-off-by: Andrew Morton <akpm@...ux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org> Signed-off-by: Sasha Levin <sashal@...nel.org> --- arch/arm/include/asm/hardirq.h | 1 + arch/arm/kernel/smp.c | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/arm/include/asm/hardirq.h b/arch/arm/include/asm/hardirq.h index cba23eaa60721..7a88f160b1fbe 100644 --- a/arch/arm/include/asm/hardirq.h +++ b/arch/arm/include/asm/hardirq.h @@ -6,6 +6,7 @@ #include <linux/threads.h> #include <asm/irq.h> +/* number of IPIS _not_ including IPI_CPU_BACKTRACE */ #define NR_IPI 7 typedef struct { diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c index a3ce7c5365fa8..bada66ef44193 100644 --- a/arch/arm/kernel/smp.c +++ b/arch/arm/kernel/smp.c @@ -76,6 +76,10 @@ enum ipi_msg_type { IPI_CPU_STOP, IPI_IRQ_WORK, IPI_COMPLETION, + /* + * CPU_BACKTRACE is special and not included in NR_IPI + * or tracable with trace_ipi_* + */ IPI_CPU_BACKTRACE, /* * SGI8-15 can be reserved by secure firmware, and thus may @@ -803,7 +807,7 @@ core_initcall(register_cpufreq_notifier); static void raise_nmi(cpumask_t *mask) { - smp_cross_call(mask, IPI_CPU_BACKTRACE); + __smp_cross_call(mask, IPI_CPU_BACKTRACE); } void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self) -- 2.20.1
Powered by blists - more mailing lists