Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Received-SPF: Pass (protection.outlook.com: domain of arm.com designates
 63.35.35.123 as permitted sender) receiver=protection.outlook.com;
 client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com;
 pr=C
Authentication-Results-Original: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=arm.com;
Date:   Tue, 1 Nov 2022 09:11:15 +0000
From:   Szabolcs Nagy <szabolcs.nagy@arm.com>
To:     "Theodore Ts'o" <tytso@mit.edu>
Cc:     linux-api@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-arm-kernel@lists.infradead.org
Subject: Re: linux interprets an fcntl int arg as long
Message-ID: <Y2DisyknbKxeCik4@arm.com>
References: <Y1/DS6uoWP7OSkmd@arm.com>
 <Y2B6jcLUJ1F2y2yL@mit.edu>
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <Y2B6jcLUJ1F2y2yL@mit.edu>
MIME-Version: 1.0
NoDisclaimer: true
X-Microsoft-Antispam-Message-Info-Original: effhx6OoF12KPBoOLd3YiH/KUanAfqguc/6N+JRmGdyY9TMpqjleZnAmHe2jdDjTVhSvzmBJa63NFqqxoqCyFqSsLx6gz2yBuHI5qCUcsOtg+f4VA7gzWBVLrnGTnoLqRWGNc8JBRA65kv1sCOhEIaB8IWyAiCx/BF/vpMQ7LO0+yk+kqf56AATsovQJZ2xVHbmuAyB7F1zIw20JZpBIoO/JxRDpWClu/HPtlbuaBiIdtsAFtK9ctM97UdaaSiqCBlbCdN6OvIwG0s1NEOYUBzoi/SV9UGk5qPPM1D55a9g1HMOgXTCzJhrtEXXO3GKn8VkAW/POtkMU7uu3Xo1cvU55bhn6kyAj8FhYQTgHD+eq0l1+b79oZFJKt6j4TEjlNcWbTNyxPogp16unNAdzmheEdVDcefr2KaS9jRrAdDUl/gyBB74ik2VlfTipJc7g10AMnN91k+1S+IkqeCJ8njL9TInwRsYChfdgzA2umTwxo6qd0iS6NL/mxcr2WT7IRDWJ1I9LGtmLtMzo4rMHAw/CWIQUEjzE4HDYJsr+0D8YBN8/rwIfORZ92CbFNjURhAttxzf/Jm5Aw36VjhMt/9C7GBTFjxStRjdQ3fz1B5rIpE2dH9qjat9EEqs79Gea+lsrYqzpEnb/AxIzAKjEsFyqjfRVS/V7qotiryRFbViYcXVIxEWpgAqnUG46HclH
X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DB9PR08MB7179.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230022)(4636009)(346002)(136003)(396003)(39860400002)(366004)(376002)(451199015)(44832011)(5660300002)(2616005)(6666004)(6506007)(86362001)(66946007)(66556008)(6512007)(36756003)(26005)(478600001)(8936002)(2906002)(6486002)(66476007)(8676002)(4326008)(38100700002)(316002)(186003)(41300700001)(6916009);DIR:OUT;SFP:1101;
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS1PR08MB7516
Original-Authentication-Results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=arm.com;
X-EOPAttributedMessage: 0
X-MS-Exchange-Transport-CrossTenantHeadersStripped: DBAEUR03FT049.eop-EUR03.prod.protection.outlook.com
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id-Prvs: 3c8c53df-6323-4b32-ceff-08dabbe90fbd
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: LY7CfukNgHz6VQjF2f0pm3gjPCWYtQZ3Q+2fjQXbydQvIY1XZs/20hUqWn+dUBUQcIT29XStsrq/hhHmBnldsqFuW2LcyD56pesK4XVz3omxm8eHO9TtJ9IL6WHFOYnVzdJDLUxIxU25/xMs6pNbv8vDiww5f8CdBinFtxuIRvRGHS5Uxl/biieqIB70FbEvfqmy0tFa28AJaPqQmxmWPeckb3YTiw0EGz+cJn91HB1qthKy1bWKB6f9w9hlm5KnH1bZll5mrHtyE0VM0ASALbxY/OeqEbBpKTZUb8jQ+7gdmZrGRNMNboLKUhWU5EVMCZl7/IBvtLzgx42fTPDDSJgaRVAq+7lVX+9ii9IhH/m0fCaqGdViVxvx0JZGmY94m+mmjYb8nyRUHfVtbRzEtRQ6jYS7FTfIkOVQxvkK/pvhMMAuhqT1T8E2xw+i0soqwfbzG7ZR/vawSijO7LNXXuAaRysZ36aLSt0aiZx3GZo50mU7ngc4Y/wbNxZpAjI//kTQZiKKVIQUeuxU6SlVx0fKfbsHp9J/My4pIvVODh9vpAURRMrL0IM8HRgmrMd77aKOrPNtj/SIUolMDpg/aVvd6LJRVV1RPoHdcWQS3nnBKkCy7d3TgnITaFxo6673BFgS/7jggey+op+WTLuK23n7W8oI3TDlXxIWo3ZTU3Qz2U7YgW9y7hKfW8PqgQzzqjb9DU+t89UvUr6cnLBmq5rSY9x7JW63lu+VoxdFBYlZ5umJsj4qO7St801ktvL2p9WGbAuRIgOSfN24hUCcvQ==
X-Forefront-Antispam-Report: CIP:63.35.35.123;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:64aa7808-outbound-1.mta.getcheckrecipient.com;PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com;CAT:NONE;SFS:(13230022)(4636009)(136003)(39860400002)(346002)(376002)(396003)(451199015)(40470700004)(36840700001)(46966006)(82310400005)(36756003)(2906002)(86362001)(336012)(40480700001)(47076005)(6486002)(356005)(41300700001)(8676002)(6862004)(5660300002)(44832011)(4326008)(81166007)(8936002)(6666004)(2616005)(70586007)(82740400003)(70206006)(316002)(36860700001)(478600001)(107886003)(40460700003)(6506007)(186003)(450100002)(6512007)(26005);DIR:OUT;SFP:1101;
X-OriginatorOrg: arm.com
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Nov 2022 09:11:38.2735
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 48212cc7-e5dd-4bfd-af14-08dabbe91533
X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d;Ip=[63.35.35.123];Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com]
X-MS-Exchange-CrossTenant-AuthSource: DBAEUR03FT049.eop-EUR03.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB7885
X-Spam-Status: No, score=-0.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,FORGED_SPF_HELO,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,
        SPF_HELO_PASS,SPF_NONE,UNPARSEABLE_RELAY autolearn=no
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The 10/31/2022 21:46, Theodore Ts'o wrote:
> On Mon, Oct 31, 2022 at 12:44:59PM +0000, Szabolcs Nagy wrote:
> > and such fcntl call can happen with c code that just passes
> > F_SEAL_WRITE since it is an int and e.g. with aarch64 pcs rules
> > it is passed in a register where top bits can be non-zero
> > (unlikely in practice but valid).
> 
> In Linux's aarch64 ABI, an int is a 4-byte value.  It is *not* an
> 8-byte value.  So passing in "F_SEAL_WRITE | 0xF00000000" as an int
> (as in your example) is simply not valid thing for the userspace
> program to do.
> 
> Now, if there is a C program which has "int c = F_SEAL_WRITE", if the
> PCS allows the compiler to pass a function paramter c --- for example
> f(a, b, c) --- where the 4-byte paramter 'c' is placed in a 64-bit
> register where the high bits of the 64-bit register contains non-zero
> garbage values, I would argue that this is a bug in the PCS and/or the
> compiler.

the callee uses va_arg(ap, type) to get the argument,
and if the type is wider than what was actually passed
then anything can happen. in practice what happens is
that the top bits can be non-zero.

many pcs are affected (aarch64 is the one i know well,
but at least x86_64, arm are affected too). and even if
it was aarch64 pcs only, it is incompetent to say that
the pcs is wrong: that's a constraint we are working with.

the kernel must not read a wider type than what it
documents as argument to variadic functions in the c api.
(it does not make much sense to expect anything there
anyway, but it can break userspace)