linux-kernel - Re: [PATCH v2] arm64: mm: Fix dead assignment of old_pte

Open Source and information security mailing list archives

Message-ID: <20190703112139.GA29570@lakrids.cambridge.arm.com>
Date:   Wed, 3 Jul 2019 12:23:12 +0100
From:   Mark Rutland <mark.rutland@....com>
To:     Nathan Huckleberry <nhuck@...gle.com>
Cc:     catalin.marinas@....com, will@...nel.org,
        clang-built-linux@...glegroups.com, linux-kernel@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH v2] arm64: mm: Fix dead assignment of old_pte

On Tue, Jul 02, 2019 at 04:41:35PM -0700, Nathan Huckleberry wrote:
> When analyzed with the clang static analyzer the
> following warning occurs
> 
> line 251, column 2
> Value stored to 'old_pte' is never read
> 
> This warning is repeated every time pgtable.h is
> included by another file and produces ~3500
> extra warnings.
> 
> Moving old_pte into preprocessor guard.
> 
> Cc: clang-built-linux@...glegroups.com
> Signed-off-by: Nathan Huckleberry <nhuck@...gle.com>
> ---
> Changes from v1 -> v2
> * Added scope to avoid [-Wdeclaration-after-statement]
>  arch/arm64/include/asm/pgtable.h | 27 ++++++++++++++++-----------
>  1 file changed, 16 insertions(+), 11 deletions(-)

As Will asked, does this also trigger in linux-next?

I rewrote this code to avoid to only perform the READ_ONCE() when we'd
use the value, and IIUC that may be sufficient to avoid the warning:

https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git/commit/?h=for-next/core&id=9b604722059039a1a3ff69fb8dfd024264046024

Thanks,
Mark.

> 
> diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
> index fca26759081a..12b7f08db40d 100644
> --- a/arch/arm64/include/asm/pgtable.h
> +++ b/arch/arm64/include/asm/pgtable.h
> @@ -238,8 +238,6 @@ extern void __sync_icache_dcache(pte_t pteval);
>  static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
>  			      pte_t *ptep, pte_t pte)
>  {
> -	pte_t old_pte;
> -
>  	if (pte_present(pte) && pte_user_exec(pte) && !pte_special(pte))
>  		__sync_icache_dcache(pte);
>  
> @@ -248,16 +246,23 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
>  	 * hardware updates of the pte (ptep_set_access_flags safely changes
>  	 * valid ptes without going through an invalid entry).
>  	 */
> -	old_pte = READ_ONCE(*ptep);
> -	if (IS_ENABLED(CONFIG_DEBUG_VM) && pte_valid(old_pte) && pte_valid(pte) &&
> -	   (mm == current->active_mm || atomic_read(&mm->mm_users) > 1)) {
> -		VM_WARN_ONCE(!pte_young(pte),
> -			     "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
> -			     __func__, pte_val(old_pte), pte_val(pte));
> -		VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
> -			     "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
> -			     __func__, pte_val(old_pte), pte_val(pte));
> +	#if IS_ENABLED(CONFIG_DEBUG_VM)
> +	{
> +		pte_t old_pte;
> +
> +		old_pte = READ_ONCE(*ptep);
> +		if (pte_valid(old_pte) && pte_valid(pte) &&
> +		  (mm == current->active_mm ||
> +		   atomic_read(&mm->mm_users) > 1)) {
> +			VM_WARN_ONCE(!pte_young(pte),
> +				     "%s: racy access flag clearing: 0x%016llx -> 0x%016llx",
> +				     __func__, pte_val(old_pte), pte_val(pte));
> +			VM_WARN_ONCE(pte_write(old_pte) && !pte_dirty(pte),
> +				     "%s: racy dirty state clearing: 0x%016llx -> 0x%016llx",
> +				     __func__, pte_val(old_pte), pte_val(pte));
> +		}
>  	}
> +	#endif
>  
>  	set_pte(ptep, pte);
>  }
> -- 
> 2.22.0.410.gd8fdbe21b5-goog
> 
> 
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel@...ts.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives