Re: [PATCH v2] powernv/opal-prd: Silence memcpy() run-time false positive warnings
On 2023-08-15 06:47, Michael Ellerman wrote: Joel Stanley writes: On Fri, 7 Jul 2023 at 05:11, Mahesh Salgaonkar wrote: opal_prd_msg_notifier extracts the opal prd message size from the message header and uses it for allocating opal_prd_msg_queue_item that includes the correct message size to be copied. However, while running under CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: [ 6458.234352] memcpy: detected field-spanning write (size 32) of single field ">msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) [ 6458.234390] WARNING: CPU: 9 PID: 660 at arch/powerpc/platforms/powernv/opal-prd.c:355 opal_prd_msg_notifier+0x174/0x188 [opal_prd] [...] [ 6458.234709] NIP [c0080e0c0e6c] opal_prd_msg_notifier+0x174/0x188 [opal_prd] [ 6458.234723] LR [c0080e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] [ 6458.234736] Call Trace: [ 6458.234742] [c002acb23c10] [c0080e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) [ 6458.234759] [c002acb23ca0] [c019ccc0] notifier_call_chain+0xc0/0x1b0 [ 6458.234774] [c002acb23d00] [c019ceac] atomic_notifier_call_chain+0x2c/0x40 [ 6458.234788] [c002acb23d20] [c00d69b4] opal_message_notify+0xf4/0x2c0 [...] Split the copy to avoid false positive run-time warning. Reported-by: Aneesh Kumar K.V Signed-off-by: Mahesh Salgaonkar I hit this on a box running the Ubuntu 6.2.0-27-generic kernel. Do we plan on merging this fix? I thought it was papering over the issue rather than fixing the root cause. I'll send a new version, as soon as I can work out how to trigger that code path. cheers Hi, I see this was still not accepted. I was able to trigger this simply by starting the opal-prd userspace daemon. Restarting the service does not re-trigger the warning, however. [Wed Nov 15 14:01:06 2023] i2c_dev: i2c /dev entries driver [Wed Nov 15 14:01:07 2023] [ cut here ] [Wed Nov 15 14:01:07 2023] memcpy: detected field-spanning write (size 32) of single field ">msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) [Wed Nov 15 14:01:07 2023] WARNING: CPU: 5 PID: 379 at arch/powerpc/platforms/powernv/opal-prd.c:355 0xc00800640b1c [Wed Nov 15 14:01:07 2023] Modules linked in: i2c_dev loop vhost_net vhost vhost_iotlb tap kvm_hv kvm bridge rpcsec_gss_krb5 auth_rpcgss tun nfsv4 dns_resolver nfs lockd grace sunrpc fscache netfs cfg80211 rfkill 8021q garp mrp stp llc nft_masq nft_chain_nat nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct binfmt_misc nbd wireguard libcurve25519_generic ip6_udp_tunnel udp_tunnel nft_nat nf_tables nfnetlink nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 at24 ast i2c_algo_bit drm_shmem_helper joydev ftdi_sio crct10dif_vpmsum onboard_usb_hub ofpart drm_kms_helper ipmi_powernv rtc_opal ipmi_devintf powernv_flash ipmi_msghandler mtd opal_prd i2c_opal vmx_crypto nvme crc32c_vpmsum tg3 nvme_core ixgbe nvme_common mdio [Wed Nov 15 14:01:07 2023] CPU: 5 PID: 379 Comm: kopald Not tainted 6.5.9-gentoo-dist #1 [Wed Nov 15 14:01:07 2023] Hardware name: T2P9S01 REV 1.01 POWER9 0x4e1203 opal:skiboot-9858186 PowerNV [Wed Nov 15 14:01:07 2023] NIP: c00800640b1c LR: c00800640b18 CTR: [Wed Nov 15 14:01:07 2023] REGS: ce2339b0 TRAP: 0700 Not tainted (6.5.9-gentoo-dist) [Wed Nov 15 14:01:07 2023] MSR: 90021033 CR: 4400 XER: [Wed Nov 15 14:01:07 2023] CFAR: c0152b10 IRQMASK: 1 GPR00: c00800640b18 ce233c50 c00800668100 0086 GPR04: 7fff ce233a10 ce233a08 001ef74d GPR08: 0027 c01ef9626d10 0001 4400 GPR12: 20646c6569662065 c01fff7fb400 c01900e8 ce919540 GPR16: GPR20: GPR24: ce959de0 0006 c00800660290 GPR28: c7498410 0020 ce959de8 c7498400 [Wed Nov 15 14:01:07 2023] NIP [c00800640b1c] 0xc00800640b1c [Wed Nov 15 14:01:07 2023] LR [c00800640b18] 0xc00800640b18 [Wed Nov 15 14:01:07 2023] Call Trace: [Wed Nov 15 14:01:07 2023] [ce233c50] [c00800640b18] 0xc00800640b18 (unreliable) [Wed Nov 15 14:01:07 2023] [ce233cd0] [c0192dd0] notifier_call_chain+0xc0/0x1b0 [Wed Nov 15 14:01:07 2023] [ce233d30] [c0192eec] atomic_notifier_call_chain+0x2c/0x40 [Wed Nov 15 14:01:07 2023] [ce233d50] [c00cec44] opal_message_notify+0xf4/0x2a0 [Wed Nov 15 14:01:07 2023] [ce233de0] [c0206d58]
Re: [PATCH v2] powernv/opal-prd: Silence memcpy() run-time false positive warnings
Joel Stanley writes: > On Fri, 7 Jul 2023 at 05:11, Mahesh Salgaonkar wrote: >> >> opal_prd_msg_notifier extracts the opal prd message size from the message >> header and uses it for allocating opal_prd_msg_queue_item that includes >> the correct message size to be copied. However, while running under >> CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: >> >> [ 6458.234352] memcpy: detected field-spanning write (size 32) of single >> field ">msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) >> [ 6458.234390] WARNING: CPU: 9 PID: 660 at >> arch/powerpc/platforms/powernv/opal-prd.c:355 >> opal_prd_msg_notifier+0x174/0x188 [opal_prd] >> [...] >> [ 6458.234709] NIP [c0080e0c0e6c] opal_prd_msg_notifier+0x174/0x188 >> [opal_prd] >> [ 6458.234723] LR [c0080e0c0e68] opal_prd_msg_notifier+0x170/0x188 >> [opal_prd] >> [ 6458.234736] Call Trace: >> [ 6458.234742] [c002acb23c10] [c0080e0c0e68] >> opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) >> [ 6458.234759] [c002acb23ca0] [c019ccc0] >> notifier_call_chain+0xc0/0x1b0 >> [ 6458.234774] [c002acb23d00] [c019ceac] >> atomic_notifier_call_chain+0x2c/0x40 >> [ 6458.234788] [c002acb23d20] [c00d69b4] >> opal_message_notify+0xf4/0x2c0 >> [...] >> >> Split the copy to avoid false positive run-time warning. >> >> Reported-by: Aneesh Kumar K.V >> Signed-off-by: Mahesh Salgaonkar > > I hit this on a box running the Ubuntu 6.2.0-27-generic kernel. > > Do we plan on merging this fix? I thought it was papering over the issue rather than fixing the root cause. I'll send a new version, as soon as I can work out how to trigger that code path. cheers
Re: [PATCH v2] powernv/opal-prd: Silence memcpy() run-time false positive warnings
On Fri, 7 Jul 2023 at 05:11, Mahesh Salgaonkar wrote: > > opal_prd_msg_notifier extracts the opal prd message size from the message > header and uses it for allocating opal_prd_msg_queue_item that includes > the correct message size to be copied. However, while running under > CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: > > [ 6458.234352] memcpy: detected field-spanning write (size 32) of single > field ">msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) > [ 6458.234390] WARNING: CPU: 9 PID: 660 at > arch/powerpc/platforms/powernv/opal-prd.c:355 > opal_prd_msg_notifier+0x174/0x188 [opal_prd] > [...] > [ 6458.234709] NIP [c0080e0c0e6c] opal_prd_msg_notifier+0x174/0x188 > [opal_prd] > [ 6458.234723] LR [c0080e0c0e68] opal_prd_msg_notifier+0x170/0x188 > [opal_prd] > [ 6458.234736] Call Trace: > [ 6458.234742] [c002acb23c10] [c0080e0c0e68] > opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) > [ 6458.234759] [c002acb23ca0] [c019ccc0] > notifier_call_chain+0xc0/0x1b0 > [ 6458.234774] [c002acb23d00] [c019ceac] > atomic_notifier_call_chain+0x2c/0x40 > [ 6458.234788] [c002acb23d20] [c00d69b4] > opal_message_notify+0xf4/0x2c0 > [...] > > Split the copy to avoid false positive run-time warning. > > Reported-by: Aneesh Kumar K.V > Signed-off-by: Mahesh Salgaonkar I hit this on a box running the Ubuntu 6.2.0-27-generic kernel. Do we plan on merging this fix? > --- > Change from v1: > - Rework the memcpy to copy message header and rest of the message > separately without adding flex array. > --- > arch/powerpc/platforms/powernv/opal-prd.c |4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/arch/powerpc/platforms/powernv/opal-prd.c > b/arch/powerpc/platforms/powernv/opal-prd.c > index 113bdb151f687..a068cbc4d43c0 100644 > --- a/arch/powerpc/platforms/powernv/opal-prd.c > +++ b/arch/powerpc/platforms/powernv/opal-prd.c > @@ -352,7 +352,9 @@ static int opal_prd_msg_notifier(struct notifier_block > *nb, > if (!item) > return -ENOMEM; > > - memcpy(>msg, msg->params, msg_size); > + item->msg = *hdr; > + hdr++; > + memcpy((char *)>msg + sizeof(*hdr), hdr, msg_size - > sizeof(*hdr)); > > spin_lock_irqsave(_prd_msg_queue_lock, flags); > list_add_tail(>list, _prd_msg_queue); > >
[PATCH v2] powernv/opal-prd: Silence memcpy() run-time false positive warnings
opal_prd_msg_notifier extracts the opal prd message size from the message header and uses it for allocating opal_prd_msg_queue_item that includes the correct message size to be copied. However, while running under CONFIG_FORTIFY_SOURCE=y, it triggers following run-time warning: [ 6458.234352] memcpy: detected field-spanning write (size 32) of single field ">msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) [ 6458.234390] WARNING: CPU: 9 PID: 660 at arch/powerpc/platforms/powernv/opal-prd.c:355 opal_prd_msg_notifier+0x174/0x188 [opal_prd] [...] [ 6458.234709] NIP [c0080e0c0e6c] opal_prd_msg_notifier+0x174/0x188 [opal_prd] [ 6458.234723] LR [c0080e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] [ 6458.234736] Call Trace: [ 6458.234742] [c002acb23c10] [c0080e0c0e68] opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) [ 6458.234759] [c002acb23ca0] [c019ccc0] notifier_call_chain+0xc0/0x1b0 [ 6458.234774] [c002acb23d00] [c019ceac] atomic_notifier_call_chain+0x2c/0x40 [ 6458.234788] [c002acb23d20] [c00d69b4] opal_message_notify+0xf4/0x2c0 [...] Split the copy to avoid false positive run-time warning. Reported-by: Aneesh Kumar K.V Signed-off-by: Mahesh Salgaonkar --- Change from v1: - Rework the memcpy to copy message header and rest of the message separately without adding flex array. --- arch/powerpc/platforms/powernv/opal-prd.c |4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/platforms/powernv/opal-prd.c b/arch/powerpc/platforms/powernv/opal-prd.c index 113bdb151f687..a068cbc4d43c0 100644 --- a/arch/powerpc/platforms/powernv/opal-prd.c +++ b/arch/powerpc/platforms/powernv/opal-prd.c @@ -352,7 +352,9 @@ static int opal_prd_msg_notifier(struct notifier_block *nb, if (!item) return -ENOMEM; - memcpy(>msg, msg->params, msg_size); + item->msg = *hdr; + hdr++; + memcpy((char *)>msg + sizeof(*hdr), hdr, msg_size - sizeof(*hdr)); spin_lock_irqsave(_prd_msg_queue_lock, flags); list_add_tail(>list, _prd_msg_queue);
