On Tue, 25 Jan 2022 22:27:32 +0900
Masami Hiramatsu <mhiramat@xxxxxxxxxx> wrote:
> > /*
> > * struct trace_event_data_offsets_<call> {
> > * u32 <item1>;
> > * u32 <item2>;
> > * [...]
> > * };
> > *
> > * The __dynamic_array() macro will create each u32 <item>, this is
> > * to keep the offset of each array from the beginning of the event.
> > * The size of an array is also encoded, in the higher 16 bits of
> > * <item>.
> > */
> >
> > So, I think -Warray-bounds is refusing to see the destination as
> > anything except a u32, but being accessed at 4 (sizeof(u32)) + 8
> > (address && 0xffff) (?)
>
> Ah, I got it. Yes, that's right. __data_loc() will access the data
> from the __entry, but the __rel_loc() points the same address from
> the encoded field ("__rel_loc_foo" in this case) itself.
> This is introduced for the user application event, which doesn't
> know the actual __entry size because the __entry includes some
> kernel internal defined fields.
>
> > But if this is true, I would imagine there would be plenty of other
> > warnings? I'm currently stumped.
>
> That is because __rel_loc is used only in the sample code in the kernel
> for testing. Other use-cases comes from user-space.
> Hmm, can we skip this boundary check for this example?
If the -Warray-bounds determines the destination array size from
the type of given pointer, we can just change the macro as below;
#define __get_rel_dynamic_array(field)
((void *)__entry + \
offsetof(typeof(*__entry), __rel_loc_##field) + \
sizeof(__entry->__rel_loc_##field) + \
(__entry->__rel_loc_##field & 0xffff))
This must works same as __get_dynamic_array() macro.
Could you try this patch?
>From 2982ba01367ec1f746a4f128512436e5325a7f9d Mon Sep 17 00:00:00 2001
From: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
Date: Tue, 25 Jan 2022 23:19:30 +0900
Subject: [PATCH] tracing: Avoid -Warray-bounds warning for __rel_loc macro
Since -Warray-bounds checks the destination size from the
type of given pointer, __assign_rel_str() macro gets warned
because it passes the pointer to the 'u32' field instead of
'trace_event_raw_*' data structure.
Pass the data address calculated from the 'trace_event_raw_*'
instead of 'u32' __rel_loc field.
Signed-off-by: Masami Hiramatsu <mhiramat@xxxxxxxxxx>
Reported-by: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
Cc: Kees Cook <keescook@xxxxxxxxxxxx>
---
include/trace/trace_events.h | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/include/trace/trace_events.h b/include/trace/trace_events.h
index 8c6f7c433518..65d927e059d3 100644
--- a/include/trace/trace_events.h
+++ b/include/trace/trace_events.h
@@ -318,9 +318,10 @@ TRACE_MAKE_SYSTEM_STR();
#define __get_str(field) ((char *)__get_dynamic_array(field))
#undef __get_rel_dynamic_array
-#define __get_rel_dynamic_array(field) \
- ((void *)(&__entry->__rel_loc_##field) + \
- sizeof(__entry->__rel_loc_##field) + \
+#define __get_rel_dynamic_array(field) \
+ ((void *)__entry + \
+ offsetof(typeof(*__entry), __rel_loc_##field) + \
+ sizeof(__entry->__rel_loc_##field) + \
(__entry->__rel_loc_##field & 0xffff))
#undef __get_rel_dynamic_array_len
--
2.25.1
--
Masami Hiramatsu <mhiramat@xxxxxxxxxx>
