On Mon, Jun 8, 2020 at 7:51 AM Will Deacon <will@xxxxxxxxxx> wrote: > > Hey Nick, > > On Tue, Jun 02, 2020 at 11:46:31AM -0700, Nick Desaulniers wrote: > > On Mon, Jun 1, 2020 at 5:03 PM Kaneda, Erik <erik.kaneda@xxxxxxxxx> wrote: > > > > Will reported UBSAN warnings: > > > > UBSAN: null-ptr-deref in drivers/acpi/acpica/tbfadt.c:459:37 > > > > UBSAN: null-ptr-deref in arch/arm64/kernel/smp.c:596:6 > > > > > > > > Looks like the emulated offsetof macro ACPI_OFFSET is causing these. We > > > > can avoid this by using the compiler builtin, __builtin_offsetof. > > > > > > I'll take a look at this tomorrow > > > > > > > > The non-kernel runtime of UBSAN would print: > > > > runtime error: member access within null pointer of type for this macro. > > > > > > actypes.h is owned by ACPICA so we typically do not allow compiler-specific > > > extensions because the code is intended to be compiled using the C99 standard > > > without compiler extensions. We could allow this sort of thing in a Linux-specific > > > header file like include/acpi/platform/aclinux.h but I'll take a look at the error as well.. > > > > If I'm not allowed to touch that header, it looks like I can include > > <linux/stddef.h> (rather than my host's <stddef.h>) to get a > > definition of `offsetof` thats implemented in terms of > > `__builtin_offsetof`. I should be able to use that to replace uses of > > ACPI_OFFSET. Are any of these off limits? > > It's not so much about not being allowed to touch the header, but rather > that the kernel imports the code from a different project: > > https://acpica.org/community > > > $ grep -rn ACPI_OFFSET > > arch/arm64/include/asm/acpi.h:34:#define ACPI_MADT_GICC_MIN_LENGTH > > ACPI_OFFSET( \ > > arch/arm64/include/asm/acpi.h:41:#define ACPI_MADT_GICC_SPE > > (ACPI_OFFSET(struct acpi_madt_generic_interrupt, \ > > I'm happy to take patches to the stuff under arch/arm64/, fwiw. Not really sure how to untangle this. Those two cases under arch/arm64/ are straightforward to fix: ``` diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index b263e239cb59..a45366c3909b 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -12,6 +12,7 @@ #include <linux/efi.h> #include <linux/memblock.h> #include <linux/psci.h> +#include <linux/stddef.h> #include <asm/cputype.h> #include <asm/io.h> @@ -31,14 +32,14 @@ * is therefore used to delimit the MADT GICC structure minimum length * appropriately. */ -#define ACPI_MADT_GICC_MIN_LENGTH ACPI_OFFSET( \ +#define ACPI_MADT_GICC_MIN_LENGTH offsetof( \ struct acpi_madt_generic_interrupt, efficiency_class) #define BAD_MADT_GICC_ENTRY(entry, end) \ (!(entry) || (entry)->header.length < ACPI_MADT_GICC_MIN_LENGTH || \ (unsigned long)(entry) + (entry)->header.length > (end)) -#define ACPI_MADT_GICC_SPE (ACPI_OFFSET(struct acpi_madt_generic_interrupt, \ +#define ACPI_MADT_GICC_SPE (offsetof(struct acpi_madt_generic_interrupt, \ spe_interrupt) + sizeof(u16)) /* Basic configuration for ACPI */ ``` But for one of the warnings you reported, as an example: UBSAN: null-ptr-deref in drivers/acpi/acpica/tbfadt.c:459:37 ``` $ ag ACPI_FADT_V2_SIZE include/acpi/actbl.h 394:#define ACPI_FADT_V2_SIZE (u32) (ACPI_FADT_OFFSET (minor_revision) + 1) drivers/acpi/acpica/tbfadt.c 459: if (acpi_gbl_FADT.header.length <= ACPI_FADT_V2_SIZE) { $ ag ACPI_FADT_OFFSET ... include/acpi/actbl.h 376:#define ACPI_FADT_OFFSET(f) (u16) ACPI_OFFSET (struct acpi_table_fadt, f) ... ``` So the use of ACPI_FADT_V2_SIZE in drivers/acpi/acpica/tbfadt.c is triggering one of the warnings. ACPI_FADT_V2_SIZE is defined in terms of ACPI_FADT_OFFSET which is defined in terms of ACPI_OFFSET in include/acpi/actbl.h. From the link you posted, include/acpi/actbl.h is from the project under source/include/. Further, drivers/acpi/acpica/tbfadt.c seems to also be from the upstream project under source/components/tables/tbfadt.c. Regardless, the second of the two warnings is definitely fixed by my above diff, so let me rephrase the previous commit message with that diff and resend. -- Thanks, ~Nick Desaulniers
