From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A17ABC001B0 for ; Thu, 10 Aug 2023 16:09:17 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id EEE546B0075; Thu, 10 Aug 2023 12:09:16 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E9EDE6B0078; Thu, 10 Aug 2023 12:09:16 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D68316B007B; Thu, 10 Aug 2023 12:09:16 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id C80406B0075 for ; Thu, 10 Aug 2023 12:09:16 -0400 (EDT) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 8E9061A10E2 for ; Thu, 10 Aug 2023 16:09:16 +0000 (UTC) X-FDA: 81108679512.02.3F2A73F Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf11.hostedemail.com (Postfix) with ESMTP id A5D0C40025 for ; Thu, 10 Aug 2023 16:09:14 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=up1xr1m+; spf=pass (imf11.hostedemail.com: domain of will@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=will@kernel.org; dmarc=pass (policy=none) header.from=kernel.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1691683754; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=/OIy61TUeI1Zyg0I4/J2JVN7PffoK6bfC+wighAjNyY=; b=6K6hZW/Uv7ZUtk/qNEUxEZs45pG3hApcxfEm7o/JRYpX//ZMqQSVaE0oaLcvX68L9EIEWT 0kzBaZYh5KacOdww/bXYBuGb+jeCehUFtQUt+u0xbGwQz2r8Bax/E6saP6WBqJSsMI6bND 64vpATd5FtazF+Jx1XuiYaIl5tmq9Ig= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1691683754; a=rsa-sha256; cv=none; b=KO/KtA8hrFGV/DqQIeHEDYnGDcCxSM8hYmiQiZ+wKlVL3mBVW8E5ekT6q8pt779dr0dumJ UZ3DOna2C6i5yWaie4M3/UQmX9g2uBQDrF3mpE7oA+fJYaM4aQ44b9i6wSThg3IgnlF/35 0p4mC/bzhY31lGsg7ee6+J9EyJCnpn8= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=kernel.org header.s=k20201202 header.b=up1xr1m+; spf=pass (imf11.hostedemail.com: domain of will@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=will@kernel.org; dmarc=pass (policy=none) header.from=kernel.org Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AC5F56628D; Thu, 10 Aug 2023 16:09:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 01839C433C8; Thu, 10 Aug 2023 16:09:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1691683753; bh=saMmtusOIsagPogxdymebzcBm3pARqxzjSu/RHEAiCc=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=up1xr1m+hF5etTJeL6VYIsO3scvWhwZ2xdd7+I0wQF9Ze0Zt5ONPUwScxALs48aIF DaLuVPnlM5wuvS1+6vYZAOsOWn5c30CJWp9hTEu43BPzModJcE/HurfFAQ+MxPktl0 rmql98mcyxWel4+FyUjhthQg3M0kL3JWOlH2SDGZyuJoGR3VVpcAIPn5j806fpNhOD AguUP6NLKdDCUE+NSPeTThVPP5mwQ3ZH88NycHa4AigfXRjfy5NMVpcZbSWn9aykxn p/SBQQ3QqfOYoezPH8g5rslC2/Smm3YAFE/OLEHLqvwIT6NIt8wxw7Ho9OPfvnTdhI OZFBP3x/X8jrg== Date: Thu, 10 Aug 2023 17:09:07 +0100 From: Will Deacon To: Robin Murphy Cc: Mark Rutland , John Hsu =?utf-8?B?KOioseawuOe/sCk=?= , "catalin.marinas@arm.com" , "linux-kernel@vger.kernel.org" , "linux-mediatek@lists.infradead.org" , Xiaobing Shi =?utf-8?B?KOWPsuWwj+WFtSk=?= , Chunhui Li =?utf-8?B?KOadjuaYpei+iSk=?= , "linux-mm@kvack.org" , Kuan-Ying Lee =?utf-8?B?KOadjuWGoOepjik=?= , Casper Li =?utf-8?B?KOadjuS4reamrik=?= , "linux-arm-kernel@lists.infradead.org" Subject: Re: [BUG kernel-5.15] aarch64: __pi_strncmp() out-of-bound error Message-ID: <20230810160907.GA5951@willie-the-truck> References: <729b1505-c466-8a71-6079-4b0d9f81731d@arm.com> <20230810143118.GA5795@willie-the-truck> <10095b14-c005-c791-7e3e-d6561dac4dec@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <10095b14-c005-c791-7e3e-d6561dac4dec@arm.com> User-Agent: Mutt/1.10.1 (2018-07-13) X-Rspamd-Queue-Id: A5D0C40025 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: xyr9dbygfmd51xfr7tskwdzq8suunrod X-HE-Tag: 1691683754-437350 X-HE-Meta: U2FsdGVkX19I2aLuWgecBZOK62U2MlOEvFjXJogKH8H/erKV4CiggTlInjnVZnKmPj5KnE6XCirHTlkBTlrLTq7NCa4vGMXlXNetCcw0AiYSZn3ZHnq5WU0WqJ20qKTf1ETUHewdM+GnS+XdPAAy4CY4/EelmEli1j8ranHjPFhQavNRYs5rW5aj36gBK/Vtii1CK/BDYapObSAcCY/841gSoJOnTmUDzyf7fyNDP83W9o+IRZtKEkVXp/WyPHSu+ige9QsTR9qYil5/lpnRjNWGzOWsMQ827hCE6tqM42RxhXQ4SifMQUWp61uz0T7apWKSn3tTtXnCv//F82xj141KnqyOzIEeQYIW6CqRQsKyK+4Oo3vBjPpSxufEgz1q51d5W0Z+vlU3BK1cctWITXcpHIMC/bUJefXZz7vutUzx57S+vfon6ZhIDVGAcKSTRupP0PDHCQTXs4imvQxvTYQoG1twnUelfEJbBmgImY0Puz7zp48A/89d6qzWzbnm6ebXO2GvM+B6Fi/IEyTLMGeZG5lqxeti09DNz2FlLCiQL8DPZtTS46hoLP562Z926mrFH8uG52ltDn8n5NmQKV4ETxXiiJuUvxAtXFw83pdN43eEuCDzZA/TwrQIfjZN/JWHbwctGPunAggUH0Qe4ydx+BPWEv2FSRySF390pbEj1YG/sBsCnqbRHUelNDrYqC5xRu9X7S5niibN370fs/TSU2PJAd8SCXAPIESQMEHrRY+dmO6lbKMRUXv3Fc7sM0eB2OyUslMLyImJJW0dPM67Mv7N4//fVvALsz3vWaSTWYEJ//U8LRppL0Ndoe6OO45PaKvolCccihkiNdiTcfizp20i5aMKnWUnQNUpED68ASuvRwxIzoKiGxsok27p5ptH4opxh213pvmpnPtt2okAzPhZUZxSNjm0VmftKRdP2mwHDtM5tOWVgypAD57+O4NnONx6BxFVm2pdEv0 cgia+b37 hbokejMKfGZCKwx4nNiAkK8oWjtfWPVl6ggFWIlfSW34pdJ46j8NH55HMODkfdGni7lOxEeE1xaoODJP5dVlFdvdafPxExihdGQwzjJq0m3ac2t1wW1Mdbvzp1K81WrRROwODDFvvLO0GLHYjP1WeuhMRTnPIEQ32sYVmOCglZ9JtcARoluemUIDUolWSqyHgUq3wL7R+CB6byzeVZn3PP9id01C4RHtz3E4IFFA2J9mKn7P7TWfQZzai9LUHnt7gAjC5hJ3osH3klCoAlYHAj2AlZlxREWPCVZIwEqlQtTOxdBmobcdayYsRStVfl+LuwBwOcOSbhmMoNS8zYgmHpGwjrSBSdZGTdnSlBijb03ISjccu0OBOkfK7i0+VbOVLAaeV X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Aug 10, 2023 at 04:00:00PM +0100, Robin Murphy wrote: > On 10/08/2023 3:31 pm, Will Deacon wrote: > > On Thu, Aug 10, 2023 at 01:23:28PM +0100, Robin Murphy wrote: > > > I'm not sure there's strictly a bug here. The C standard says: > > > > > > "The strncmp function compares not more than n characters (characters that > > > follow a null character are not compared) ..." > > > > > > so although any characters between the first NULL and n must not be > > > considered for the result of the comparison, there doesn't seem to be any > > > explicit promise anywhere that they can't be *accessed*. AFAICT what happens > > > here is in the request to compare at most 23 characters, it ends up in the > > > do_misaligned case, loop_misaligned runs twice and finds no differences or > > > NULLs in characters 0-7 and 8-15, so then done_loop loads characters 15-23 > > > to compare the last 7, and is tripped up by 22-23 not actually existing in > > > src2. Possibly the original intent was that this case should have ended up > > > in page_end_loop, and the condition for that was slightly off, but I'm not > > > sure, and this code is obsolete now anyway. > > > > The long backtrace above worries me, as it suggests that you can trigger > > this from userspace. In that case I think it's a bug regardless of what > > the C standard says. > > Bleh, poor choice of words... obviously there is a bug overall, it just > might arguably be in the caller's expectations rather than the strncmp() > implementation itself. However I would concur that there's no way we're > going over all ~3000 strncmp() callsites with the "well, actually" comb just > for this. It was more to say I don't think it's worth digging much deeper > into exactly why, and I agree the pragmatic thing to do is either rip it out > or backport the newer MTE-safe implementation which should be more robust. Heh, then we agree. I was worried you'd gone mad :) Will