Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Tue, 21 Sep 2021 10:35:58 -0700
From:   Nick Desaulniers <ndesaulniers@google.com>
To:     Anders Roxell <anders.roxell@linaro.org>
Cc:     Thomas Gleixner <tglx@linutronix.de>,
        LKML <linux-kernel@vger.kernel.org>,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@kernel.org>,
        Al Viro <viro@zeniv.linux.org.uk>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Tony Luck <tony.luck@intel.com>,
        Alexei Starovoitov <ast@kernel.org>,
        Peter Ziljstra <peterz@infradead.org>,
        Song Liu <songliubraving@fb.com>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Nathan Chancellor <nathan@kernel.org>,
        Andrew Cooper <andrew.cooper3@citrix.org>
Subject: Re: [patch V3 15/20] x86/fpu/signal: Change return type of
 copy_fpregs_to_sigframe() helpers to boolean
Message-ID: <YUoX/lVugPnd/ZiK@google.com>
References: <20210908130922.118265849@linutronix.de>
 <20210908132525.794334915@linutronix.de>
 <CADYN=9K1BdyupzcDAbyk2JTio1A98J9tsBS_LeOH4=GVG=7FqQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CADYN=9K1BdyupzcDAbyk2JTio1A98J9tsBS_LeOH4=GVG=7FqQ@mail.gmail.com>
Precedence: bulk

On Tue, Sep 21, 2021 at 12:58:34PM +0200, Anders Roxell wrote:
> On Wed, 8 Sept 2021 at 15:30, Thomas Gleixner <tglx@linutronix.de> wrote:
> >
> > Now that copy_fpregs_to_sigframe() returns boolean the individual return
> > codes in the related helper functions do not make sense anymore. Change
> > them to return boolean success/fail.
> >
> > Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> 
> When I build and boot (qemu_x86_64) a defconfig kernel on from todays
> next tag next-20210921 I see the following segmentation fault
> 
> 2021-09-21T10:11:45 <6>[    1.622922] mount (89) used greatest stack
> depth: 14384 bytes left
> 2021-09-21T10:11:45 <6>[    1.664760] EXT4-fs (sda): re-mounted. Opts:
> (null). Quota mode: none.
> 2021-09-21T10:11:45 <6>[    1.691041] mkdir (92) used greatest stack
> depth: 14312 bytes left
> 2021-09-21T10:11:45 <6>[    1.713201] mount (93) used greatest stack
> depth: 13720 bytes left
> 2021-09-21T10:11:46 Starting syslogd: /etc/init.d/rcS: line 12:   101
> Segmentation fault      $i start
> 
> 
> I did a bisection and found this as the faulty patch [1]. When I
> revert this patch I can't see the issue.
> 
> We noticed that function 'save_xstate_epilog()' changes the polarity
> of its return code for one of the return statements, and for its only
> caller. but not for the other return statement.
> 
> I tried this patch and I couldn't see the segmentation fault.
> 
> diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c
> index 445c57c9c539..61eeebc04427 100644
> --- a/arch/x86/kernel/fpu/signal.c
> +++ b/arch/x86/kernel/fpu/signal.c
> @@ -104,7 +104,7 @@ static inline int save_xstate_epilog(void __user
> *buf, int ia32_frame)
>         err = __copy_to_user(&x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes));
> 
>         if (!use_xsave())
> -               return err;
> +               return !err;
> 
>         err |= __put_user(FP_XSTATE_MAGIC2,
>                           (__u32 __user *)(buf + fpu_user_xstate_size));

Thank for the report.  Our CI watching tip has also been super red over
the past day or so; all boot failures.

Andrew Cooper reported this diff to me on IRC; I tested out the above
and it fixes the boot failure for us.

Tested-by: Nick Desaulniers <ndesaulniers@google.com>
Link: https://github.com/ClangBuiltLinux/linux/issues/1461

Our CI used -cpu Nehalem for qemu since KVM isn't exposed to the bots on
github actions, FWIW.
https://github.com/ClangBuiltLinux/boot-utils/blob/2edbca214f9a4cabd3f138ea029015d6cf52d110/boot-qemu.sh#L278-L288

> 
> 
> 
> Cheers,
> Anders
> [1] http://ix.io/3zxf
> 
> > ---
> >  arch/x86/kernel/fpu/signal.c |   17 +++++++++--------
> >  1 file changed, 9 insertions(+), 8 deletions(-)
> >
> > --- a/arch/x86/kernel/fpu/signal.c
> > +++ b/arch/x86/kernel/fpu/signal.c
> > @@ -65,7 +65,7 @@ static inline int check_xstate_in_sigfra
> >  /*
> >   * Signal frame handlers.
> >   */
> > -static inline int save_fsave_header(struct task_struct *tsk, void __user *buf)
> > +static inline bool save_fsave_header(struct task_struct *tsk, void __user *buf)
> >  {
> >         if (use_fxsr()) {
> >                 struct xregs_state *xsave = &tsk->thread.fpu.state.xsave;
> > @@ -82,18 +82,19 @@ static inline int save_fsave_header(stru
> >                 if (__copy_to_user(buf, &env, sizeof(env)) ||
> >                     __put_user(xsave->i387.swd, &fp->status) ||
> >                     __put_user(X86_FXSR_MAGIC, &fp->magic))
> > -                       return -1;
> > +                       return false;
> >         } else {
> >                 struct fregs_state __user *fp = buf;
> >                 u32 swd;
> > +
> >                 if (__get_user(swd, &fp->swd) || __put_user(swd, &fp->status))
> > -                       return -1;
> > +                       return false;
> >         }
> >
> > -       return 0;
> > +       return true;
> >  }
> >
> > -static inline int save_xstate_epilog(void __user *buf, int ia32_frame)
> > +static inline bool save_xstate_epilog(void __user *buf, int ia32_frame)
> >  {
> >         struct xregs_state __user *x = buf;
> >         struct _fpx_sw_bytes *sw_bytes;
> > @@ -131,7 +132,7 @@ static inline int save_xstate_epilog(voi
> >
> >         err |= __put_user(xfeatures, (__u32 __user *)&x->header.xfeatures);
> >
> > -       return err;
> > +       return !err;
> >  }
> >
> >  static inline int copy_fpregs_to_sigframe(struct xregs_state __user *buf)
> > @@ -219,10 +220,10 @@ bool copy_fpstate_to_sigframe(void __use
> >         }
> >
> >         /* Save the fsave header for the 32-bit frames. */
> > -       if ((ia32_fxstate || !use_fxsr()) && save_fsave_header(tsk, buf))
> > +       if ((ia32_fxstate || !use_fxsr()) && !save_fsave_header(tsk, buf))
> >                 return false;
> >
> > -       if (use_fxsr() && save_xstate_epilog(buf_fx, ia32_fxstate))
> > +       if (use_fxsr() && !save_xstate_epilog(buf_fx, ia32_fxstate))
> >                 return false;
> >
> >         return true;
> >