Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Content-Type: text/plain;
        charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3696.120.41.1.1\))
Subject: Re: [PATCH] riscv: elf: add .riscv.attributes parsing
From:   Jessica Clarke <jrtc27@jrtc27.com>
In-Reply-To: <6dcdd143-ff1c-41f7-9f46-0c4505575669@rivosinc.com>
Date:   Tue, 10 Jan 2023 23:21:59 +0000
Cc:     linux-riscv <linux-riscv@lists.infradead.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        Palmer Dabbelt <palmer@rivosinc.com>,
        Paul Walmsley <paul.walmsley@sifive.com>,
        Albert Ou <aou@eecs.berkeley.edu>,
        Eric Biederman <ebiederm@xmission.com>,
        Kees Cook <keescook@chromium.org>, Guo Ren <guoren@kernel.org>,
        Greentime Hu <greentime.hu@sifive.com>,
        Conor Dooley <conor.dooley@microchip.com>, linux@rivosinc.com,
        kernel test robot <lkp@intel.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <9061941F-3221-467D-B0FC-DCA8E8FF3996@jrtc27.com>
References: <20230110201841.2069353-1-vineetg@rivosinc.com>
 <01AF458D-1EDC-47D1-A902-A686E2DF26AF@jrtc27.com>
 <6dcdd143-ff1c-41f7-9f46-0c4505575669@rivosinc.com>
To:     Vineet Gupta <vineetg@rivosinc.com>
Precedence: bulk

On 10 Jan 2023, at 21:50, Vineet Gupta <vineetg@rivosinc.com> wrote:
> On 1/10/23 12:48, Jessica Clarke wrote:
>> On 10 Jan 2023, at 20:18, Vineet Gupta <vineetg@rivosinc.com> wrote:
>>> This implements the elf loader hook to parse RV specific
>>> .riscv.attributes section. This section is inserted by compilers
>>> (gcc/llvm) with build related information such as -march organized =
as
>>> tag/value attribute pairs.
>>>=20
>>> It identifies the various attribute tags (and corresponding values) =
as
>>> currently specified in the psABI specification.
>>>=20
>>> This patch only implements the elf parsing mechanics, leaving out =
the
>>> recording/usage of the attributes to subsequent patches.
>>>=20
>>> Reported-by: kernel test robot <lkp@intel.com>  # code under =
CONFIG_COMPAT
>>> Signed-off-by: Vineet Gupta <vineetg@rivosinc.com>
>> This code is full of buffer overruns and uninitialised reads in the
>> presence of malicious files,
>=20
> While the outer loop is bound, indeed the internal pointer increments =
could get oob.
> I don't recall seeing existing explicit "safe" pointer, so thinking of =
cooking something up.
> The conceptual idea is to replace
>=20
>     p +=3D 4
>=20
> with
>=20
>    PTR_INC(p, 4, p_max)
>=20
> And similarly replace
>=20
>     while (*p++ !=3D '\0')
>=20
> with
>=20
>     while (*p !=3D '\0')
>           PTR_INC(p, 1, p_max)
>=20
> Is that sufficient or you had something else in mind.

I=E2=80=99d be very careful about obfuscating control flow but how you
implement it is between you and other kernel developers, which I don=E2=80=
=99t
count myself as.

>> and fails to check the version, vendor and sub-subsection tag.
>=20
> That is now added.
>=20
>> You also should handle more than one sub-subsection even if tools =
don=E2=80=99t
>> emit it today.
>=20
> Just to be on same page, a sub-section implies the following
>=20
>       uint32:len, NTBS:vendor-name, uint8: Tag_file, uint32:data-len, =
<tag><value>....
>=20
> If so, the code does support multiple of these

That=E2=80=99s a sub-section, but I said sub-subsection.

Jess

>> You also have an unaligned access for reading the sub-subsection=E2=80=99=
s data
>> length (maybe that=E2=80=99s ok in kernel land, but worth making =
sure).
>=20
> True, I've added get_unaligned_le32 for those now
>=20
> Thx,
> -Vineet