On Tue, Aug 13, 2019 at 02:19:30PM -0700, Nick Desaulniers wrote:
> commit 4ce97317f41d38584fb93578e922fcd19e535f5b upstream.
>
> Implementing memcpy and memset in terms of __builtin_memcpy and
> __builtin_memset is problematic.
>
> GCC at -O2 will replace calls to the builtins with calls to memcpy and
> memset (but will generate an inline implementation at -Os). Clang will
> replace the builtins with these calls regardless of optimization level.
> $ llvm-objdump -dr arch/x86/purgatory/string.o | tail
>
> 0000000000000339 memcpy:
> 339: 48 b8 00 00 00 00 00 00 00 00 movabsq $0, %rax
> 000000000000033b: R_X86_64_64 memcpy
> 343: ff e0 jmpq *%rax
>
> 0000000000000345 memset:
> 345: 48 b8 00 00 00 00 00 00 00 00 movabsq $0, %rax
> 0000000000000347: R_X86_64_64 memset
> 34f: ff e0
>
> Such code results in infinite recursion at runtime. This is observed
> when doing kexec.
>
> Instead, reuse an implementation from arch/x86/boot/compressed/string.c.
> This requires to implement a stub function for warn(). Also, Clang may
> lower memcmp's that compare against 0 to bcmp's, so add a small definition,
> too. See also: commit 5f074f3e192f ("lib/string.c: implement a basic bcmp")
>
> Fixes: 8fc5b4d4121c ("purgatory: core purgatory functionality")
> Reported-by: Vaibhav Rustagi <vaibhavrustagi@xxxxxxxxxx>
> Debugged-by: Vaibhav Rustagi <vaibhavrustagi@xxxxxxxxxx>
> Debugged-by: Manoj Gupta <manojgupta@xxxxxxxxxx>
> Suggested-by: Alistair Delva <adelva@xxxxxxxxxx>
> Signed-off-by: Nick Desaulniers <ndesaulniers@xxxxxxxxxx>
> Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
> Tested-by: Vaibhav Rustagi <vaibhavrustagi@xxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> Link: https://bugs.chromium.org/p/chromium/issues/detail?id=984056
> Link: https://lkml.kernel.org/r/20190807221539.94583-1-ndesaulniers@xxxxxxxxxx
> ---
> This failed to cherry-pick back cleanly due to the SPDX license
> identifier not existing in arch/x86/purgatory/string.c in 4.19. `git rm`
> it anyway.
Now queued up, thanks.
So the Fixes: tag does not mean this should be backported to anything
older? It implies this bug has been in the kernel since the 3.17
release.
thanks,
greg k-h
