From: Wang Qing <[email protected]>
fix memdup_user.cocci warning:
fs/xattr.c:563:11-19: WARNING opportunity for vmemdup_user
Signed-off-by: Wang Qing <[email protected]>
---
fs/xattr.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/fs/xattr.c b/fs/xattr.c
index 5c8c517..71c301d
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -560,11 +560,9 @@ setxattr(struct user_namespace *mnt_userns, struct dentry *d,
if (size) {
if (size > XATTR_SIZE_MAX)
return -E2BIG;
- kvalue = kvmalloc(size, GFP_KERNEL);
- if (!kvalue)
- return -ENOMEM;
- if (copy_from_user(kvalue, value, size)) {
- error = -EFAULT;
+ kvalue = vmemdup_user(value, size);
+ if (IS_ERR(kvalue)) {
+ error = PTR_ERR(kvalue);
goto out;
}
if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
--
2.7.4
On Tue, Dec 14, 2021 at 04:19:17AM -0800, Qing Wang wrote:
> From: Wang Qing <[email protected]>
>
> fix memdup_user.cocci warning:
> fs/xattr.c:563:11-19: WARNING opportunity for vmemdup_user
>
> Signed-off-by: Wang Qing <[email protected]>
> ---
> fs/xattr.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/fs/xattr.c b/fs/xattr.c
> index 5c8c517..71c301d
> --- a/fs/xattr.c
> +++ b/fs/xattr.c
> @@ -560,11 +560,9 @@ setxattr(struct user_namespace *mnt_userns, struct dentry *d,
> if (size) {
> if (size > XATTR_SIZE_MAX)
> return -E2BIG;
> - kvalue = kvmalloc(size, GFP_KERNEL);
> - if (!kvalue)
> - return -ENOMEM;
> - if (copy_from_user(kvalue, value, size)) {
> - error = -EFAULT;
> + kvalue = vmemdup_user(value, size);
This changes the allocation type from GFP_KERNEL to GFP_USER which is
probably not what we need at least it's not clear to me that it is.
Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: 7db4f4924732b9d808323c194d01ba46cb0a6804 ("[PATCH] fs: xattr: use vmemdup_user instead of kvmalloc and copy_from_user")
url: https://github.com/0day-ci/linux/commits/Qing-Wang/fs-xattr-use-vmemdup_user-instead-of-kvmalloc-and-copy_from_user/20211214-203042
base: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git 5472f14a37421d1bca3dddf33cabd3bd6dbefbbc
patch link: https://lore.kernel.org/linux-fsdevel/[email protected]
in testcase: trinity
version: trinity-x86_64-608712d8-1_20211207
with following parameters:
runtime: 300s
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <[email protected]>
[ 167.936478][ T765] WARNING: CPU: 0 PID: 765 at mm/slub.c:3546 kfree (mm/slub.c:3546 mm/slub.c:4558)
[ 167.944125][ T765] Modules linked in: mpls_router ip_tunnel vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock vmw_vmci ieee802154_socket ieee802154 hidp bnep rfcomm bluetooth ecdh_generic ecc rfkill can_bcm can_raw can crypto_user ib_core nfnetlink scsi_transport_iscsi atm sctp ip6_udp_tunnel udp_tunnel libcrc32c bochs drm_vram_helper drm_ttm_helper sr_mod cdrom ttm sg drm_kms_helper intel_rapl_msr ppdev syscopyarea sysfillrect sysimgblt fb_sys_fops intel_rapl_common crct10dif_pclmul ata_generic crc32_pclmul crc32c_intel drm ghash_clmulni_intel ata_piix rapl libata joydev ipmi_devintf ipmi_msghandler parport_pc parport serio_raw i2c_piix4 ip_tables
[ 167.979813][ T765] CPU: 0 PID: 765 Comm: trinity-c0 Not tainted 5.16.0-rc5-00011-g7db4f4924732 #1
[ 167.985942][ T765] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 168.003434][ T765] RIP: 0010:kfree (mm/slub.c:3546 mm/slub.c:4558)
[ 168.008352][ T765] Code: 5b 5d 41 5c 41 5d 41 5e 41 5f e9 2a 56 f8 ff 48 c7 c0 00 00 00 80 48 2b 05 1c 14 94 02 e9 cb fd ff ff 48 8b 45 08 a8 01 75 9c <0f> 0b 80 3d ea c1 8c 03 00 75 91 e9 c8 4f c3 01 48 83 c4 20 4d 89
All code
========
0: 5b pop %rbx
1: 5d pop %rbp
2: 41 5c pop %r12
4: 41 5d pop %r13
6: 41 5e pop %r14
8: 41 5f pop %r15
a: e9 2a 56 f8 ff jmpq 0xfffffffffff85639
f: 48 c7 c0 00 00 00 80 mov $0xffffffff80000000,%rax
16: 48 2b 05 1c 14 94 02 sub 0x294141c(%rip),%rax # 0x2941439
1d: e9 cb fd ff ff jmpq 0xfffffffffffffded
22: 48 8b 45 08 mov 0x8(%rbp),%rax
26: a8 01 test $0x1,%al
28: 75 9c jne 0xffffffffffffffc6
2a:* 0f 0b ud2 <-- trapping instruction
2c: 80 3d ea c1 8c 03 00 cmpb $0x0,0x38cc1ea(%rip) # 0x38cc21d
33: 75 91 jne 0xffffffffffffffc6
35: e9 c8 4f c3 01 jmpq 0x1c35002
3a: 48 83 c4 20 add $0x20,%rsp
3e: 4d rex.WRB
3f: 89 .byte 0x89
Code starting with the faulting instruction
===========================================
0: 0f 0b ud2
2: 80 3d ea c1 8c 03 00 cmpb $0x0,0x38cc1ea(%rip) # 0x38cc1f3
9: 75 91 jne 0xffffffffffffff9c
b: e9 c8 4f c3 01 jmpq 0x1c34fd8
10: 48 83 c4 20 add $0x20,%rsp
14: 4d rex.WRB
15: 89 .byte 0x89
[ 168.024132][ T765] RSP: 0018:ffffc900007bfce0 EFLAGS: 00010246
[ 168.029363][ T765] RAX: ffffea000d587fc8 RBX: fffffffffffffff2 RCX: ffff88813e712000
[ 168.036716][ T765] RDX: 0000000000000000 RSI: ffffffffad1c9c41 RDI: fffffffffffffff2
[ 168.043435][ T765] RBP: ffffea000d587fc0 R08: 0000000000000000 R09: 00000000800000b1
[ 168.049825][ T765] R10: fffffffffffffff2 R11: fffff520000f7f32 R12: 00000000fffff000
[ 168.058150][ T765] R13: 0000000000000000 R14: 00007fc0e7b75000 R15: 0000000000000118
[ 168.064474][ T765] FS: 00007fc0e9a0a740(0000) GS:ffff88839d600000(0000) knlGS:0000000000000000
[ 168.080763][ T765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 168.086854][ T765] CR2: 00007fc0e7b75000 CR3: 000000017088c000 CR4: 00000000000406f0
[ 168.096288][ T765] DR0: 00007fc0e7b79000 DR1: 0000000000000000 DR2: 0000000000000000
[ 168.102811][ T765] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
[ 168.112088][ T765] Call Trace:
[ 168.117553][ T765] <TASK>
[ 168.124123][ T765] setxattr (fs/xattr.c:577)
[ 168.129544][ T765] ? vfs_setxattr (fs/xattr.c:546)
[ 168.136661][ T765] ? hrtimer_run_softirq (kernel/time/hrtimer.c:1282)
[ 168.143200][ T765] ? _raw_spin_lock_irq (arch/x86/include/asm/atomic.h:202 include/linux/atomic/atomic-instrumented.h:513 include/asm-generic/qspinlock.h:82 include/linux/spinlock.h:185 include/linux/spinlock_api_smp.h:120 kernel/locking/spinlock.c:170)
[ 168.148495][ T765] ? _raw_spin_lock_bh (kernel/locking/spinlock.c:169)
[ 168.155573][ T765] ? do_setitimer (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/timer.h:304 kernel/time/itimer.c:237)
[ 168.160453][ T765] ? perf_syscall_exit (arch/x86/include/asm/bitops.h:214 include/asm-generic/bitops/instrumented-non-atomic.h:135 kernel/trace/trace_syscalls.c:701)
[ 168.167183][ T765] ? ftrace_syscall_enter (kernel/trace/trace_syscalls.c:689)
[ 168.172090][ T765] ? do_setitimer (kernel/time/itimer.c:278)
[ 168.178594][ T765] __x64_sys_fsetxattr (fs/xattr.c:633 fs/xattr.c:619 fs/xattr.c:619)
[ 168.183397][ T765] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 168.189609][ T765] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:113)
[ 168.194470][ T765] RIP: 0033:0x7fc0e9b21f59
[ 168.201233][ T765] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 07 6f 0c 00 f7 d8 64 89 01 48
All code
========
0: 00 c3 add %al,%bl
2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
9: 00 00 00
c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 retq
33: 48 8b 0d 07 6f 0c 00 mov 0xc6f07(%rip),%rcx # 0xc6f41
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 retq
9: 48 8b 0d 07 6f 0c 00 mov 0xc6f07(%rip),%rcx # 0xc6f17
10: f7 d8 neg %eax
12: 64 89 01 mov %eax,%fs:(%rcx)
15: 48 rex.W
[ 168.213071][ T765] RSP: 002b:00007fff477e7e28 EFLAGS: 00000246 ORIG_RAX: 00000000000000be
[ 168.223301][ T765] RAX: ffffffffffffffda RBX: 00000000000000be RCX: 00007fc0e9b21f59
[ 168.228861][ T765] RDX: 00007fc0e7b75000 RSI: 00007fc0e8379000 RDI: 0000000000000047
[ 168.237714][ T765] RBP: 00000000000000be R08: 0000000000000001 R09: 0000000074000000
[ 168.244590][ T765] R10: 0000000000000118 R11: 0000000000000246 R12: 0000000000000002
[ 168.249970][ T765] R13: 00007fc0e84ae058 R14: 00007fc0e9a0a6c0 R15: 00007fc0e84ae000
[ 168.258232][ T765] </TASK>
[ 168.262635][ T765] ---[ end trace 7d9d01eb3000a5e3 ]---
[ 168.268992][ T765] object pointer: 0xfffffffffffffff2
[ 168.273757][ T765] ==================================================================
To reproduce:
# build kernel
cd linux
cp config-5.16.0-rc5-00011-g7db4f4924732 .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/[email protected] Intel Corporation
Thanks,
Oliver Sang