Messages in this thread | | | Subject | Re: [PATCH] drm/amd/pm: And destination bounds checking to struct copy | From | Christian König <> | Date | Mon, 23 Aug 2021 08:28:54 +0200 |
| |
Am 19.08.21 um 22:14 schrieb Kees Cook: > In preparation for FORTIFY_SOURCE performing compile-time and run-time > field bounds checking for memcpy(), memmove(), and memset(), avoid > intentionally writing across neighboring fields. > > The "Board Parameters" members of the structs: > struct atom_smc_dpm_info_v4_5 > struct atom_smc_dpm_info_v4_6 > struct atom_smc_dpm_info_v4_7 > struct atom_smc_dpm_info_v4_10 > are written to the corresponding members of the corresponding PPTable_t > variables, but they lack destination size bounds checking, which means > the compiler cannot verify at compile time that this is an intended and > safe memcpy(). > > Since the header files are effectively immutable[1] and a struct_group() > cannot be used, nor a common struct referenced by both sides of the > memcpy() arguments, add a new helper, memcpy_trailing(), to perform the > bounds checking at compile time. Replace the open-coded memcpy()s with > memcpy_trailing() which includes enough context for the bounds checking. > > "objdump -d" shows no object code changes. > > [1] https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Flkml%2Fe56aad3c-a06f-da07-f491-a894a570d78f%40amd.com&data=04%7C01%7Cchristian.koenig%40amd.com%7C63c17764a7c84cc85d7a08d9634dfe37%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637650008924776466%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=TbxGZSLP0HegTcF4qFn0cnFW8SR47X0wmuf1y75ygFw%3D&reserved=0 > > Cc: Lijo Lazar <lijo.lazar@amd.com> > Cc: "Christian König" <christian.koenig@amd.com> > Cc: "Pan, Xinhui" <Xinhui.Pan@amd.com> > Cc: David Airlie <airlied@linux.ie> > Cc: Daniel Vetter <daniel@ffwll.ch> > Cc: Hawking Zhang <Hawking.Zhang@amd.com> > Cc: Feifei Xu <Feifei.Xu@amd.com> > Cc: Likun Gao <Likun.Gao@amd.com> > Cc: Jiawei Gu <Jiawei.Gu@amd.com> > Cc: Evan Quan <evan.quan@amd.com> > Cc: amd-gfx@lists.freedesktop.org > Cc: dri-devel@lists.freedesktop.org > Signed-off-by: Kees Cook <keescook@chromium.org> > Link: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Flkml%2FCADnq5_Npb8uYvd%2BR4UHgf-w8-cQj3JoODjviJR_Y9w9wqJ71mQ%40mail.gmail.com&data=04%7C01%7Cchristian.koenig%40amd.com%7C63c17764a7c84cc85d7a08d9634dfe37%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637650008924786462%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=yCGfiaYVLayZKc9Ahq1axpjztJQ8KVIJ4tMI6Z7LoMQ%3D&reserved=0 > --- > Alex, I dropped your prior Acked-by, since the implementation is very > different. If you're still happy with it, I can add it back. :) > --- > drivers/gpu/drm/amd/amdgpu/amdgpu.h | 25 +++++++++++++++++++ > .../gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 6 ++--- > .../gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c | 8 +++--- > .../drm/amd/pm/swsmu/smu13/aldebaran_ppt.c | 5 ++-- > 4 files changed, 33 insertions(+), 11 deletions(-) > > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h > index 96e895d6be35..4605934a4fb7 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h > @@ -1446,4 +1446,29 @@ static inline int amdgpu_in_reset(struct amdgpu_device *adev) > { > return atomic_read(&adev->in_gpu_reset); > } > + > +/** > + * memcpy_trailing - Copy the end of one structure into the middle of another > + * > + * @dst: Pointer to destination struct > + * @first_dst_member: The member name in @dst where the overwrite begins > + * @last_dst_member: The member name in @dst where the overwrite ends after > + * @src: Pointer to the source struct > + * @first_src_member: The member name in @src where the copy begins > + * > + */ > +#define memcpy_trailing(dst, first_dst_member, last_dst_member, \ > + src, first_src_member) \
Please don't add a function like this into amdgpu.h, especially when it is only used by the SMU code.
And please give it an amdgpu_ prefix so that we are not confusing it with a core function.
Apart from that looks good to me.
Thanks, Christian.
> +({ \ > + size_t __src_offset = offsetof(typeof(*(src)), first_src_member); \ > + size_t __src_size = sizeof(*(src)) - __src_offset; \ > + size_t __dst_offset = offsetof(typeof(*(dst)), first_dst_member); \ > + size_t __dst_size = offsetofend(typeof(*(dst)), last_dst_member) - \ > + __dst_offset; \ > + BUILD_BUG_ON(__src_size != __dst_size); \ > + __builtin_memcpy((u8 *)(dst) + __dst_offset, \ > + (u8 *)(src) + __src_offset, \ > + __dst_size); \ > +}) > + > #endif > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c > index 8ab58781ae13..1918e6232319 100644 > --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c > @@ -465,10 +465,8 @@ static int arcturus_append_powerplay_table(struct smu_context *smu) > > if ((smc_dpm_table->table_header.format_revision == 4) && > (smc_dpm_table->table_header.content_revision == 6)) > - memcpy(&smc_pptable->MaxVoltageStepGfx, > - &smc_dpm_table->maxvoltagestepgfx, > - sizeof(*smc_dpm_table) - offsetof(struct atom_smc_dpm_info_v4_6, maxvoltagestepgfx)); > - > + memcpy_trailing(smc_pptable, MaxVoltageStepGfx, BoardReserved, > + smc_dpm_table, maxvoltagestepgfx); > return 0; > } > > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c > index 2e5d3669652b..b738042e064d 100644 > --- a/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/navi10_ppt.c > @@ -431,16 +431,16 @@ static int navi10_append_powerplay_table(struct smu_context *smu) > > switch (smc_dpm_table->table_header.content_revision) { > case 5: /* nv10 and nv14 */ > - memcpy(smc_pptable->I2cControllers, smc_dpm_table->I2cControllers, > - sizeof(*smc_dpm_table) - sizeof(smc_dpm_table->table_header)); > + memcpy_trailing(smc_pptable, I2cControllers, BoardReserved, > + smc_dpm_table, I2cControllers); > break; > case 7: /* nv12 */ > ret = amdgpu_atombios_get_data_table(adev, index, NULL, NULL, NULL, > (uint8_t **)&smc_dpm_table_v4_7); > if (ret) > return ret; > - memcpy(smc_pptable->I2cControllers, smc_dpm_table_v4_7->I2cControllers, > - sizeof(*smc_dpm_table_v4_7) - sizeof(smc_dpm_table_v4_7->table_header)); > + memcpy_trailing(smc_pptable, I2cControllers, BoardReserved, > + smc_dpm_table_v4_7, I2cControllers); > break; > default: > dev_err(smu->adev->dev, "smc_dpm_info with unsupported content revision %d!\n", > diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c > index c8eefacfdd37..a6fd7ee314a9 100644 > --- a/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c > +++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/aldebaran_ppt.c > @@ -409,9 +409,8 @@ static int aldebaran_append_powerplay_table(struct smu_context *smu) > > if ((smc_dpm_table->table_header.format_revision == 4) && > (smc_dpm_table->table_header.content_revision == 10)) > - memcpy(&smc_pptable->GfxMaxCurrent, > - &smc_dpm_table->GfxMaxCurrent, > - sizeof(*smc_dpm_table) - offsetof(struct atom_smc_dpm_info_v4_10, GfxMaxCurrent)); > + memcpy_trailing(smc_pptable, GfxMaxCurrent, reserved, > + smc_dpm_table, GfxMaxCurrent); > return 0; > } >
| |