Skip to contentSkip to conversation

s390/kexec: check the return value of ipl_report_finish

PATCH In review Baoquan He 3 participants 12 messages Nov 16, 2021 – Nov 26, 2021

Subsystems (3)
lore
Share & tools
lore

Baoquan He

author
#0 lore raw

PATCH v2 1/2 s390/kexec: check the return value of ipl_report_finish

In function ipl_report_finish(), it could fail by memory allocation failure, so check the return value to handle the case.

---
 arch/s390/include/asm/ipl.h           | 2 +-
 arch/s390/kernel/ipl.c                | 6 ++++--
 arch/s390/kernel/machine_kexec_file.c | 5 ++++-
 3 files changed, 9 insertions(+), 4 deletions(-)
arch/s390/include/asm/ipl.h +1 -1
index 3f8ee257f9aa..864ab5d2890c 100644
@@ -122,7 +122,7 @@ struct ipl_report_certificate {
 
 struct kexec_buf;
 struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib);
-void *ipl_report_finish(struct ipl_report *report);
+int ipl_report_finish(struct ipl_report *report, void **ipl_buf);
 int ipl_report_free(struct ipl_report *report);
 int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
 			     unsigned char flags, unsigned short cert);
arch/s390/kernel/ipl.c +4 -2
index e2cc35775b99..a0af0b23148d 100644
@@ -2144,7 +2144,7 @@ struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib)
 	return report;
 }
 
-void *ipl_report_finish(struct ipl_report *report)
+int ipl_report_finish(struct ipl_report *report, void **ipl_buf)
 {
 	struct ipl_report_certificate *cert;
 	struct ipl_report_component *comp;
@@ -2195,7 +2195,9 @@ void *ipl_report_finish(struct ipl_report *report)
 	}
 
 	BUG_ON(ptr > buf + report->size);
-	return buf;
+	*ipl_buf = buf;
+
+	return 0;
 }
 
 int ipl_report_free(struct ipl_report *report)
arch/s390/kernel/machine_kexec_file.c +4 -1
index 528edff085d9..17e961975624 100644
@@ -170,6 +170,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 	struct kexec_buf buf;
 	unsigned long addr;
 	void *ptr, *end;
+	int ret;
 
 	buf.image = image;
 
@@ -199,7 +200,9 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		ptr += len;
 	}
 
-	buf.buffer = ipl_report_finish(data->report);
+	ret = ipl_report_finish(data->report, &buf.buffer);
+	if (ret)
+		return ret;
 	buf.bufsz = data->report->size;
 	buf.memsz = buf.bufsz;
 
Signature · 7 lines
2.17.2


_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec
author
#1 lore raw

PATCH v2 2/2 s390/kexec: fix kmemleak

unreferenced object 0x38000195000 (size 4096):
comm "kexec", pid 8548, jiffies 4294953647 (age 32443.270s) hex dump (first 32 bytes):

    00 00 00 c8 20 00 00 00 00 00 00 c0 02 80 00 00  .... ...........
    40 40 40 40 40 40 40 40 00 00 00 00 00 00 00 00  @@@@@@@@........
  backtrace:
    [<0000000011a2f199>] __vmalloc_node_range+0xc0/0x140
    [<0000000081fa2752>] vzalloc+0x5a/0x70
    [<0000000063a4c92d>] ipl_report_finish+0x2c/0x180
    [<00000000553304da>] kexec_file_add_ipl_report+0xf4/0x150
    [<00000000862d033f>] kexec_file_add_components+0x124/0x160
    [<000000000d2717bb>] arch_kexec_kernel_image_load+0x62/0x90
    [<000000002e0373b6>] kimage_file_alloc_init+0x1aa/0x2e0
    [<0000000060f2d14f>] __do_sys_kexec_file_load+0x17c/0x2c0
    [<000000008c86fe5a>] __s390x_sys_kexec_file_load+0x40/0x50
    [<000000001fdb9dac>] __do_syscall+0x1bc/0x1f0
    [<000000003ee4258d>] system_call+0x78/0xa0
Fixes 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel")
---
 arch/s390/include/asm/kexec.h         | 7 +++++++
 arch/s390/kernel/machine_kexec_file.c | 9 +++++++++
 2 files changed, 16 insertions(+)
arch/s390/include/asm/kexec.h +7 -0
index ea398a05f643..bbe125dd0329 100644
@@ -74,6 +74,13 @@ void *kexec_file_add_components(struct kimage *image,
 int arch_kexec_do_relocs(int r_type, void *loc, unsigned long val,
 			 unsigned long addr);
 
+#define ARCH_HAS_KIMAGE_ARCH
+
+struct kimage_arch {
+        void *ipl_buf;
+};
+
+
 extern const struct kexec_file_ops s390_kexec_image_ops;
 extern const struct kexec_file_ops s390_kexec_elf_ops;
 
arch/s390/kernel/machine_kexec_file.c +9 -0
index 17e961975624..7f51837e9bc2 100644
@@ -205,6 +205,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		return ret;
 	buf.bufsz = data->report->size;
 	buf.memsz = buf.bufsz;
+	image->arch.ipl_buf = buf.buffer;
 
 	data->memsz += buf.memsz;
 
@@ -325,3 +326,11 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
 	}
 	return 0;
 }
+
+int arch_kimage_file_post_load_cleanup(struct kimage *image)
+{
+	kvfree(image->arch.ipl_buf);
+	image->arch.ipl_buf = NULL;
+
+	return kexec_image_post_load_cleanup_default(image);
+}
Signature · 7 lines
2.17.2


_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec
author
#2 lore raw

PATCH RESEND v2 2/2 s390/kexec: fix memory leak of ipl report buffer

unreferenced object 0x38000195000 (size 4096):
comm "kexec", pid 8548, jiffies 4294953647 (age 32443.270s) hex dump (first 32 bytes):

    00 00 00 c8 20 00 00 00 00 00 00 c0 02 80 00 00  .... ...........
    40 40 40 40 40 40 40 40 00 00 00 00 00 00 00 00  @@@@@@@@........
  backtrace:
    [<0000000011a2f199>] __vmalloc_node_range+0xc0/0x140
    [<0000000081fa2752>] vzalloc+0x5a/0x70
    [<0000000063a4c92d>] ipl_report_finish+0x2c/0x180
    [<00000000553304da>] kexec_file_add_ipl_report+0xf4/0x150
    [<00000000862d033f>] kexec_file_add_components+0x124/0x160
    [<000000000d2717bb>] arch_kexec_kernel_image_load+0x62/0x90
    [<000000002e0373b6>] kimage_file_alloc_init+0x1aa/0x2e0
    [<0000000060f2d14f>] __do_sys_kexec_file_load+0x17c/0x2c0
    [<000000008c86fe5a>] __s390x_sys_kexec_file_load+0x40/0x50
    [<000000001fdb9dac>] __do_syscall+0x1bc/0x1f0
    [<000000003ee4258d>] system_call+0x78/0xa0
Fixes 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel")

---
RESEND:
Fix the incorrect subject.

 arch/s390/include/asm/kexec.h         | 7 +++++++
 arch/s390/kernel/machine_kexec_file.c | 9 +++++++++
 2 files changed, 16 insertions(+)
arch/s390/include/asm/kexec.h +7 -0
index ea398a05f643..bbe125dd0329 100644
@@ -74,6 +74,13 @@ void *kexec_file_add_components(struct kimage *image,
 int arch_kexec_do_relocs(int r_type, void *loc, unsigned long val,
 			 unsigned long addr);
 
+#define ARCH_HAS_KIMAGE_ARCH
+
+struct kimage_arch {
+        void *ipl_buf;
+};
+
+
 extern const struct kexec_file_ops s390_kexec_image_ops;
 extern const struct kexec_file_ops s390_kexec_elf_ops;
 
arch/s390/kernel/machine_kexec_file.c +9 -0
index 17e961975624..7f51837e9bc2 100644
@@ -205,6 +205,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		return ret;
 	buf.bufsz = data->report->size;
 	buf.memsz = buf.bufsz;
+	image->arch.ipl_buf = buf.buffer;
 
 	data->memsz += buf.memsz;
 
@@ -325,3 +326,11 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
 	}
 	return 0;
 }
+
+int arch_kimage_file_post_load_cleanup(struct kimage *image)
+{
+	kvfree(image->arch.ipl_buf);
+	image->arch.ipl_buf = NULL;
+
+	return kexec_image_post_load_cleanup_default(image);
+}
Signature · 7 lines
2.17.2


_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec
maintainer Applied
#3 lore raw

Re: [PATCH v2 RESEND 2/2] s390/kexec: fix memory leak of ipl report buffer

Quoted 20 lines · Baoquan He

unreferenced object 0x38000195000 (size 4096):
comm "kexec", pid 8548, jiffies 4294953647 (age 32443.270s) hex dump (first 32 bytes):

    00 00 00 c8 20 00 00 00 00 00 00 c0 02 80 00 00  .... ...........
    40 40 40 40 40 40 40 40 00 00 00 00 00 00 00 00  @@@@@@@@........
  backtrace:
    [<0000000011a2f199>] __vmalloc_node_range+0xc0/0x140
    [<0000000081fa2752>] vzalloc+0x5a/0x70
    [<0000000063a4c92d>] ipl_report_finish+0x2c/0x180
    [<00000000553304da>] kexec_file_add_ipl_report+0xf4/0x150
    [<00000000862d033f>] kexec_file_add_components+0x124/0x160
    [<000000000d2717bb>] arch_kexec_kernel_image_load+0x62/0x90
    [<000000002e0373b6>] kimage_file_alloc_init+0x1aa/0x2e0
    [<0000000060f2d14f>] __do_sys_kexec_file_load+0x17c/0x2c0
    [<000000008c86fe5a>] __s390x_sys_kexec_file_load+0x40/0x50
    [<000000001fdb9dac>] __do_syscall+0x1bc/0x1f0
    [<000000003ee4258d>] system_call+0x78/0xa0
Fixes 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel")
Quoted 7 lines

---
RESEND:
Fix the incorrect subject.

 arch/s390/include/asm/kexec.h         | 7 +++++++
 arch/s390/kernel/machine_kexec_file.c | 9 +++++++++
 2 files changed, 16 insertions(+)

Applied, thanks!

_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec

#4 lore raw

Re: [PATCH v2 2/2] s390/kexec: fix kmemleak

In reply to Baoquan He
I love your patch! Yet something to improve:

Hi Baoquan,

I love your patch! Yet something to improve:

[auto build test ERROR on s390/features]
[also build test ERROR on linux/master linus/master v5.16-rc1 next-20211117] [cannot apply to kvms390/next]
[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827
base:   https://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git features
config: s390-allmodconfig (attached as .config)
compiler: s390-linux-gcc (GCC) 11.2.0

reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/d5463ab680d37f95b493b71c487a51c039dfe845
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827 git checkout d5463ab680d37f95b493b71c487a51c039dfe845
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=s390

If you fix the issue, kindly add following tag as appropriate

All errors (new ones prefixed by >>):

arch/s390/kernel/machine_kexec_file.c: In function 'arch_kimage_file_post_load_cleanup':

>> arch/s390/kernel/machine_kexec_file.c:332:9: error: implicit declaration of function 'kvfree'; did you mean 'vfree'? [-Werror=implicit-function-declaration]
     332 |         kvfree(image->arch.ipl_buf);
         |         ^~~~~~
         |         vfree

cc1: some warnings being treated as errors

vim +332 arch/s390/kernel/machine_kexec_file.c

329
330 int arch_kimage_file_post_load_cleanup(struct kimage *image)
331 {

 > 332		kvfree(image->arch.ipl_buf);

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

author
#5 lore raw

Re: [PATCH v2 2/2] s390/kexec: fix kmemleak

Quoted 28 lines · kernel test robot

Hi Baoquan,

I love your patch! Yet something to improve:

[auto build test ERROR on s390/features]
[also build test ERROR on linux/master linus/master v5.16-rc1 next-20211117] [cannot apply to kvms390/next]
[If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827
base:   https://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git features
config: s390-allmodconfig (attached as .config)
compiler: s390-linux-gcc (GCC) 11.2.0

reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/d5463ab680d37f95b493b71c487a51c039dfe845
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827 git checkout d5463ab680d37f95b493b71c487a51c039dfe845
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=s390

If you fix the issue, kindly add following tag as appropriate

Quoted 7 lines

All errors (new ones prefixed by >>):

arch/s390/kernel/machine_kexec_file.c: In function 'arch_kimage_file_post_load_cleanup':

Quoted 1 line
Quoted 1 line

arch/s390/kernel/machine_kexec_file.c:332:9: error: implicit declaration of function 'kvfree'; did you mean 'vfree'? [-Werror=implicit-function-declaration]

     332 |         kvfree(image->arch.ipl_buf);
         |         ^~~~~~
         |         vfree

OK, kvfree is not wrong, seems vfree is more appropriate since it's clear the ipl_buf is allocated with zvalloc() in ipl_report_finish().

Hi Heiko,

Could you help modify the code in your tree or append below patch to mute the lkp complaint? Sorry for the inconvenience.

Quoted 1 line

From 8ff5547d0b31093bb361328bc9df8bf19e96155a Mon Sep 17 00:00:00 2001

From: Baoquan He <[email protected]>
Date: Thu, 18 Nov 2021 14:37:53 +0800
Subject: [PATCH] s390/kexec: use vfree to free memory from vmalloc

Since it's clear that memory is allocated with vzalloc in ipl_report_finish(), let's use vfree to free the memory instead since it's more efficient than kvfree.

This fixes the warning reported by lkp.

---
 arch/s390/kernel/machine_kexec_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/machine_kexec_file.c +1 -1
index 7f51837e9bc2..351a7ff69a43 100644
@@ -329,7 +329,7 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
 
 int arch_kimage_file_post_load_cleanup(struct kimage *image)
 {
-	kvfree(image->arch.ipl_buf);
+	vfree(image->arch.ipl_buf);
 	image->arch.ipl_buf = NULL;
 
 	return kexec_image_post_load_cleanup_default(image);
Signature · 1 line
2.17.2
maintainer
#6 lore raw

Re: [PATCH v2 2/2] s390/kexec: fix kmemleak

Quoted 14 lines · Baoquan He
Quoted 5 lines · kernel test robot

arch/s390/kernel/machine_kexec_file.c: In function 'arch_kimage_file_post_load_cleanup':

Quoted 1 line
Quoted 1 line

arch/s390/kernel/machine_kexec_file.c:332:9: error: implicit declaration of function 'kvfree'; did you mean 'vfree'? [-Werror=implicit-function-declaration]

     332 |         kvfree(image->arch.ipl_buf);
         |         ^~~~~~
         |         vfree

OK, kvfree is not wrong, seems vfree is more appropriate since it's clear the ipl_buf is allocated with zvalloc() in ipl_report_finish().

Hi Heiko,

Could you help modify the code in your tree or append below patch to mute the lkp complaint? Sorry for the inconvenience.

...

arch/s390/kernel/machine_kexec_file.c int arch_kexec_apply_relocations_add(struct purgatory_info *pi, · line 332

Quoted 13 lines
 arch/s390/kernel/machine_kexec_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/machine_kexec_file.c +1 -1
index 7f51837e9bc2..351a7ff69a43 100644
@@ -329,7 +329,7 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
 
 int arch_kimage_file_post_load_cleanup(struct kimage *image)
 {
-	kvfree(image->arch.ipl_buf);
+	vfree(image->arch.ipl_buf);

The problem reported above indicates that slab.h was not included. With your patch, while it fixes the problem for this particular configuration, this requires vmalloc.h to be included.

I'll merge your patch and add the missing include as well.

author
#7 lore raw

Re: [PATCH v2 2/2] s390/kexec: fix kmemleak

Quoted 25 lines · Heiko Carstens
Quoted 14 lines · Baoquan He
Quoted 5 lines · kernel test robot

arch/s390/kernel/machine_kexec_file.c: In function 'arch_kimage_file_post_load_cleanup':

Quoted 1 line
Quoted 1 line

arch/s390/kernel/machine_kexec_file.c:332:9: error: implicit declaration of function 'kvfree'; did you mean 'vfree'? [-Werror=implicit-function-declaration]

     332 |         kvfree(image->arch.ipl_buf);
         |         ^~~~~~
         |         vfree

OK, kvfree is not wrong, seems vfree is more appropriate since it's clear the ipl_buf is allocated with zvalloc() in ipl_report_finish().

Hi Heiko,

Could you help modify the code in your tree or append below patch to mute the lkp complaint? Sorry for the inconvenience.

...

Quoted 9 lines
 arch/s390/kernel/machine_kexec_file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/kernel/machine_kexec_file.c +0 -0
index 7f51837e9bc2..351a7ff69a43 100644
@@ -329,7 +329,7 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
 
Quoted 8 lines

arch/s390/kernel/machine_kexec_file.c int arch_kexec_apply_relocations_add(struct purgatory_info *pi, · line 332

Quoted 4 lines
arch/s390/kernel/machine_kexec_file.c +1 -1
 int arch_kimage_file_post_load_cleanup(struct kimage *image)
 {
-	kvfree(image->arch.ipl_buf);
+	vfree(image->arch.ipl_buf);

The problem reported above indicates that slab.h was not included. With your patch, while it fixes the problem for this particular configuration, this requires vmalloc.h to be included.

Indeed, thanks.

Quoted 3 lines

I'll merge your patch and add the missing include as well.

maintainer
#8 lore raw
In reply to Baoquan He
Quoted 37 lines · Baoquan He

In function ipl_report_finish(), it could fail by memory allocation failure, so check the return value to handle the case.

---
 arch/s390/include/asm/ipl.h           | 2 +-
 arch/s390/kernel/ipl.c                | 6 ++++--
 arch/s390/kernel/machine_kexec_file.c | 5 ++++-
 3 files changed, 9 insertions(+), 4 deletions(-)
arch/s390/include/asm/ipl.h +1 -1
index 3f8ee257f9aa..864ab5d2890c 100644
@@ -122,7 +122,7 @@ struct ipl_report_certificate {
 
 struct kexec_buf;
 struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib);
-void *ipl_report_finish(struct ipl_report *report);
+int ipl_report_finish(struct ipl_report *report, void **ipl_buf);
 int ipl_report_free(struct ipl_report *report);
 int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
 			     unsigned char flags, unsigned short cert);
arch/s390/kernel/ipl.c +1 -1
index e2cc35775b99..a0af0b23148d 100644
@@ -2144,7 +2144,7 @@ struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib)
 	return report;
 }
 
-void *ipl_report_finish(struct ipl_report *report)
+int ipl_report_finish(struct ipl_report *report, void **ipl_buf)
 {
 	struct ipl_report_certificate *cert;
 	struct ipl_report_component *comp;

arch/s390/kernel/ipl.c void *ipl_report_finish(struct ipl_report *report) · line 2200

Quoted 7 lines
arch/s390/kernel/ipl.c +3 -1
@@ -2195,7 +2195,9 @@ void *ipl_report_finish(struct ipl_report *report)
 	}
 
 	BUG_ON(ptr > buf + report->size);
-	return buf;
+	*ipl_buf = buf;
+
+	return 0;

This does not compile:

CC arch/s390/kernel/ipl.o
arch/s390/kernel/ipl.c: In function ‘ipl_report_finish’:
arch/s390/kernel/ipl.c:2159:24: warning: returning ‘void *’ from a function with return type ‘int’ makes integer from pointer without a cast [-Wint-conversion]

 2159 |                 return ERR_PTR(-ENOMEM);
      |                        ^~~~~~~~~~~~~~~~

Anyway, before we are going to have more iterations I just applied the patch below instead before applying your memory leak fix.

From 78e5f268d1be775354ab83c1e039dcfacaa5e258 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <[email protected]>
Date: Tue, 16 Nov 2021 11:06:38 +0100
Subject: s390/kexec: fix return code handling

kexec_file_add_ipl_report ignores that ipl_report_finish may fail and can return an error pointer instead of a valid pointer. Fix this and simplify by returning NULL in case of an error and let the only caller handle this case.

Fixes 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel")
---
 arch/s390/kernel/ipl.c                | 3 ++-
 arch/s390/kernel/machine_kexec_file.c | 8 +++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)
arch/s390/kernel/ipl.c +2 -1
index e2cc35775b99..5ad1dde23dc5 100644
@@ -2156,7 +2156,7 @@ void *ipl_report_finish(struct ipl_report *report)
 
 	buf = vzalloc(report->size);
 	if (!buf)
-		return ERR_PTR(-ENOMEM);
+		goto out;
 	ptr = buf;
 
 	memcpy(ptr, report->ipib, report->ipib->hdr.len);
@@ -2195,6 +2195,7 @@ void *ipl_report_finish(struct ipl_report *report)
 	}
 
 	BUG_ON(ptr > buf + report->size);
+out:
 	return buf;
 }
 
arch/s390/kernel/machine_kexec_file.c +7 -1
index 528edff085d9..f0200b503f94 100644
@@ -170,6 +170,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 	struct kexec_buf buf;
 	unsigned long addr;
 	void *ptr, *end;
+	int ret;
 
 	buf.image = image;
 
@@ -199,7 +200,10 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		ptr += len;
 	}
 
+	ret = -ENOMEM;
 	buf.buffer = ipl_report_finish(data->report);
+	if (!buf.buffer)
+		goto out;
 	buf.bufsz = data->report->size;
 	buf.memsz = buf.bufsz;
 
@@ -209,7 +213,9 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		data->kernel_buf + offsetof(struct lowcore, ipl_parmblock_ptr);
 	*lc_ipl_parmblock_ptr = (__u32)buf.mem;
 
-	return kexec_add_buffer(&buf);
+	ret = kexec_add_buffer(&buf);
+out:
+	return ret;
 }
 
 void *kexec_file_add_components(struct kimage *image,
Signature · 6 lines
2.31.1

_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec
author
#9 lore raw
Quoted 48 lines · Heiko Carstens
Quoted 37 lines · Baoquan He

In function ipl_report_finish(), it could fail by memory allocation failure, so check the return value to handle the case.

---
 arch/s390/include/asm/ipl.h           | 2 +-
 arch/s390/kernel/ipl.c                | 6 ++++--
 arch/s390/kernel/machine_kexec_file.c | 5 ++++-
 3 files changed, 9 insertions(+), 4 deletions(-)
arch/s390/include/asm/ipl.h +1 -1
index 3f8ee257f9aa..864ab5d2890c 100644
@@ -122,7 +122,7 @@ struct ipl_report_certificate {
 
 struct kexec_buf;
 struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib);
-void *ipl_report_finish(struct ipl_report *report);
+int ipl_report_finish(struct ipl_report *report, void **ipl_buf);
 int ipl_report_free(struct ipl_report *report);
 int ipl_report_add_component(struct ipl_report *report, struct kexec_buf *kbuf,
 			     unsigned char flags, unsigned short cert);
arch/s390/kernel/ipl.c +1 -1
index e2cc35775b99..a0af0b23148d 100644
@@ -2144,7 +2144,7 @@ struct ipl_report *ipl_report_init(struct ipl_parameter_block *ipib)
 	return report;
 }
 
-void *ipl_report_finish(struct ipl_report *report)
+int ipl_report_finish(struct ipl_report *report, void **ipl_buf)
 {
 	struct ipl_report_certificate *cert;
 	struct ipl_report_component *comp;

arch/s390/kernel/ipl.c void *ipl_report_finish(struct ipl_report *report) · line 2200

Quoted 7 lines
arch/s390/kernel/ipl.c +3 -1
@@ -2195,7 +2195,9 @@ void *ipl_report_finish(struct ipl_report *report)
 	}
 
 	BUG_ON(ptr > buf + report->size);
-	return buf;
+	*ipl_buf = buf;
+
+	return 0;

This does not compile:

Quoted 5 lines

CC arch/s390/kernel/ipl.o
arch/s390/kernel/ipl.c: In function ‘ipl_report_finish’:
arch/s390/kernel/ipl.c:2159:24: warning: returning ‘void *’ from a function with return type ‘int’ makes integer from pointer without a cast [-Wint-conversion]

 2159 |                 return ERR_PTR(-ENOMEM);
      |                        ^~~~~~~~~~~~~~~~

Oops, I forgot changing this place to "return -ENOMEM;". Thanks for taking care of it with below patch.

Quoted 79 lines

Anyway, before we are going to have more iterations I just applied the patch below instead before applying your memory leak fix.

From 78e5f268d1be775354ab83c1e039dcfacaa5e258 Mon Sep 17 00:00:00 2001
From: Heiko Carstens <[email protected]>
Date: Tue, 16 Nov 2021 11:06:38 +0100
Subject: s390/kexec: fix return code handling

kexec_file_add_ipl_report ignores that ipl_report_finish may fail and can return an error pointer instead of a valid pointer. Fix this and simplify by returning NULL in case of an error and let the only caller handle this case.

Fixes 99feaa717e55 ("s390/kexec_file: Create ipl report and pass to next kernel")
---
 arch/s390/kernel/ipl.c                | 3 ++-
 arch/s390/kernel/machine_kexec_file.c | 8 +++++++-
 2 files changed, 9 insertions(+), 2 deletions(-)
arch/s390/kernel/ipl.c +2 -1
index e2cc35775b99..5ad1dde23dc5 100644
@@ -2156,7 +2156,7 @@ void *ipl_report_finish(struct ipl_report *report)
 
 	buf = vzalloc(report->size);
 	if (!buf)
-		return ERR_PTR(-ENOMEM);
+		goto out;
 	ptr = buf;
 
 	memcpy(ptr, report->ipib, report->ipib->hdr.len);
@@ -2195,6 +2195,7 @@ void *ipl_report_finish(struct ipl_report *report)
 	}
 
 	BUG_ON(ptr > buf + report->size);
+out:
 	return buf;
 }
 
arch/s390/kernel/machine_kexec_file.c +7 -1
index 528edff085d9..f0200b503f94 100644
@@ -170,6 +170,7 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 	struct kexec_buf buf;
 	unsigned long addr;
 	void *ptr, *end;
+	int ret;
 
 	buf.image = image;
 
@@ -199,7 +200,10 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		ptr += len;
 	}
 
+	ret = -ENOMEM;
 	buf.buffer = ipl_report_finish(data->report);
+	if (!buf.buffer)
+		goto out;
 	buf.bufsz = data->report->size;
 	buf.memsz = buf.bufsz;
 
@@ -209,7 +213,9 @@ static int kexec_file_add_ipl_report(struct kimage *image,
 		data->kernel_buf + offsetof(struct lowcore, ipl_parmblock_ptr);
 	*lc_ipl_parmblock_ptr = (__u32)buf.mem;
 
-	return kexec_add_buffer(&buf);
+	ret = kexec_add_buffer(&buf);
+out:
+	return ret;
 }
 
 void *kexec_file_add_components(struct kimage *image,
Signature · 1 line
2.31.1

_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec

#10 lore raw
In reply to Baoquan He
I love your patch! Perhaps something to improve:

Hi Baoquan,

I love your patch! Perhaps something to improve:

[auto build test WARNING on s390/features]
[also build test WARNING on kvms390/next]
[cannot apply to linux/master linus/master v5.16-rc2 next-20211126] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827
base:   https://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git features
config: s390-allyesconfig (https://download.01.org/0day-ci/archive/20211126/202111261649.WZQbFG5g-lkp(a)intel.com/config)
compiler: s390-linux-gcc (GCC) 11.2.0

reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/27ed543b2d76a1d948c64d4404c180ba31ca8cff
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827 git checkout 27ed543b2d76a1d948c64d4404c180ba31ca8cff
# save the config file to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=s390

If you fix the issue, kindly add following tag as appropriate

All warnings (new ones prefixed by >>):

arch/s390/kernel/ipl.c: In function 'ipl_report_finish':

>> arch/s390/kernel/ipl.c:2159:24: warning: returning 'void *' from a function with return type 'int' makes integer from pointer without a cast [-Wint-conversion]
    2159 |                 return ERR_PTR(-ENOMEM);
         |                        ^~~~~~~~~~~~~~~~

vim +2159 arch/s390/kernel/ipl.c

937347ac56bfca Martin Schwidefsky 2019-02-25  2146  
27ed543b2d76a1 Baoquan He         2021-11-16  2147  int ipl_report_finish(struct ipl_report *report, void **ipl_buf)
937347ac56bfca Martin Schwidefsky 2019-02-25  2148  {
937347ac56bfca Martin Schwidefsky 2019-02-25  2149  	struct ipl_report_certificate *cert;
937347ac56bfca Martin Schwidefsky 2019-02-25  2150  	struct ipl_report_component *comp;
937347ac56bfca Martin Schwidefsky 2019-02-25  2151  	struct ipl_rb_certificates *certs;
937347ac56bfca Martin Schwidefsky 2019-02-25  2152  	struct ipl_parameter_block *ipib;
937347ac56bfca Martin Schwidefsky 2019-02-25  2153  	struct ipl_rb_components *comps;
937347ac56bfca Martin Schwidefsky 2019-02-25  2154  	struct ipl_rl_hdr *rl_hdr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2155  	void *buf, *ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2156  
937347ac56bfca Martin Schwidefsky 2019-02-25  2157  	buf = vzalloc(report->size);
937347ac56bfca Martin Schwidefsky 2019-02-25  2158  	if (!buf)
937347ac56bfca Martin Schwidefsky 2019-02-25 @2159  		return ERR_PTR(-ENOMEM);
937347ac56bfca Martin Schwidefsky 2019-02-25  2160  	ptr = buf;
937347ac56bfca Martin Schwidefsky 2019-02-25  2161  
937347ac56bfca Martin Schwidefsky 2019-02-25  2162  	memcpy(ptr, report->ipib, report->ipib->hdr.len);
937347ac56bfca Martin Schwidefsky 2019-02-25  2163  	ipib = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2164  	if (ipl_secure_flag)
937347ac56bfca Martin Schwidefsky 2019-02-25  2165  		ipib->hdr.flags |= IPL_PL_FLAG_SIPL;
937347ac56bfca Martin Schwidefsky 2019-02-25  2166  	ipib->hdr.flags |= IPL_PL_FLAG_IPLSR;
937347ac56bfca Martin Schwidefsky 2019-02-25  2167  	ptr += report->ipib->hdr.len;
937347ac56bfca Martin Schwidefsky 2019-02-25  2168  	ptr = PTR_ALIGN(ptr, 8);
937347ac56bfca Martin Schwidefsky 2019-02-25  2169  
937347ac56bfca Martin Schwidefsky 2019-02-25  2170  	rl_hdr = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2171  	ptr += sizeof(*rl_hdr);
937347ac56bfca Martin Schwidefsky 2019-02-25  2172  
937347ac56bfca Martin Schwidefsky 2019-02-25  2173  	comps = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2174  	comps->rbt = IPL_RBT_COMPONENTS;
937347ac56bfca Martin Schwidefsky 2019-02-25  2175  	ptr += sizeof(*comps);
937347ac56bfca Martin Schwidefsky 2019-02-25  2176  	list_for_each_entry(comp, &report->components, list) {
937347ac56bfca Martin Schwidefsky 2019-02-25  2177  		memcpy(ptr, &comp->entry, sizeof(comp->entry));
937347ac56bfca Martin Schwidefsky 2019-02-25  2178  		ptr += sizeof(comp->entry);
937347ac56bfca Martin Schwidefsky 2019-02-25  2179  	}
937347ac56bfca Martin Schwidefsky 2019-02-25  2180  	comps->len = ptr - (void *)comps;
937347ac56bfca Martin Schwidefsky 2019-02-25  2181  
937347ac56bfca Martin Schwidefsky 2019-02-25  2182  	certs = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2183  	certs->rbt = IPL_RBT_CERTIFICATES;
937347ac56bfca Martin Schwidefsky 2019-02-25  2184  	ptr += sizeof(*certs);
937347ac56bfca Martin Schwidefsky 2019-02-25  2185  	list_for_each_entry(cert, &report->certificates, list) {
937347ac56bfca Martin Schwidefsky 2019-02-25  2186  		memcpy(ptr, &cert->entry, sizeof(cert->entry));
937347ac56bfca Martin Schwidefsky 2019-02-25  2187  		ptr += sizeof(cert->entry);
937347ac56bfca Martin Schwidefsky 2019-02-25  2188  	}
937347ac56bfca Martin Schwidefsky 2019-02-25  2189  	certs->len = ptr - (void *)certs;
937347ac56bfca Martin Schwidefsky 2019-02-25  2190  	rl_hdr->len = ptr - (void *)rl_hdr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2191  
937347ac56bfca Martin Schwidefsky 2019-02-25  2192  	list_for_each_entry(cert, &report->certificates, list) {
937347ac56bfca Martin Schwidefsky 2019-02-25  2193  		memcpy(ptr, cert->key, cert->entry.len);
937347ac56bfca Martin Schwidefsky 2019-02-25  2194  		ptr += cert->entry.len;
937347ac56bfca Martin Schwidefsky 2019-02-25  2195  	}
937347ac56bfca Martin Schwidefsky 2019-02-25  2196  
937347ac56bfca Martin Schwidefsky 2019-02-25  2197  	BUG_ON(ptr > buf + report->size);
27ed543b2d76a1 Baoquan He         2021-11-16  2198  	*ipl_buf = buf;
27ed543b2d76a1 Baoquan He         2021-11-16  2199  
27ed543b2d76a1 Baoquan He         2021-11-16  2200  	return 0;
937347ac56bfca Martin Schwidefsky 2019-02-25  2201  }
937347ac56bfca Martin Schwidefsky 2019-02-25  2202  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

author
#11 lore raw

Hi,

Quoted 26 lines · kernel test robot

Hi Baoquan,

I love your patch! Perhaps something to improve:

[auto build test WARNING on s390/features]
[also build test WARNING on kvms390/next]
[cannot apply to linux/master linus/master v5.16-rc2 next-20211126] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827
base:   https://git.kernel.org/pub/scm/linux/kernel/git/s390/linux.git features
config: s390-allyesconfig (https://download.01.org/0day-ci/archive/20211126/202111261649.WZQbFG5g-lkp(a)intel.com/config)
compiler: s390-linux-gcc (GCC) 11.2.0

reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/27ed543b2d76a1d948c64d4404c180ba31ca8cff
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Baoquan-He/s390-kexec-check-the-return-value-of-ipl_report_finish/20211116-112827 git checkout 27ed543b2d76a1d948c64d4404c180ba31ca8cff
# save the config file to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=s390

If you fix the issue, kindly add following tag as appropriate

Quoted 8 lines

All warnings (new ones prefixed by >>):

arch/s390/kernel/ipl.c: In function 'ipl_report_finish':

Quoted 1 line
Quoted 1 line

arch/s390/kernel/ipl.c:2159:24: warning: returning 'void *' from a function with return type 'int' makes integer from pointer without a cast [-Wint-conversion]

    2159 |                 return ERR_PTR(-ENOMEM);
         |                        ^~~~~~~~~~~~~~~~

S390 maintainer has taken another way to fix the issue, so this patch 1/1 is dropped, then this issue identified by lkp doesn't exist any more.

Quoted 66 lines

vim +2159 arch/s390/kernel/ipl.c

937347ac56bfca Martin Schwidefsky 2019-02-25  2146  
27ed543b2d76a1 Baoquan He         2021-11-16  2147  int ipl_report_finish(struct ipl_report *report, void **ipl_buf)
937347ac56bfca Martin Schwidefsky 2019-02-25  2148  {
937347ac56bfca Martin Schwidefsky 2019-02-25  2149  	struct ipl_report_certificate *cert;
937347ac56bfca Martin Schwidefsky 2019-02-25  2150  	struct ipl_report_component *comp;
937347ac56bfca Martin Schwidefsky 2019-02-25  2151  	struct ipl_rb_certificates *certs;
937347ac56bfca Martin Schwidefsky 2019-02-25  2152  	struct ipl_parameter_block *ipib;
937347ac56bfca Martin Schwidefsky 2019-02-25  2153  	struct ipl_rb_components *comps;
937347ac56bfca Martin Schwidefsky 2019-02-25  2154  	struct ipl_rl_hdr *rl_hdr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2155  	void *buf, *ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2156  
937347ac56bfca Martin Schwidefsky 2019-02-25  2157  	buf = vzalloc(report->size);
937347ac56bfca Martin Schwidefsky 2019-02-25  2158  	if (!buf)
937347ac56bfca Martin Schwidefsky 2019-02-25 @2159  		return ERR_PTR(-ENOMEM);
937347ac56bfca Martin Schwidefsky 2019-02-25  2160  	ptr = buf;
937347ac56bfca Martin Schwidefsky 2019-02-25  2161  
937347ac56bfca Martin Schwidefsky 2019-02-25  2162  	memcpy(ptr, report->ipib, report->ipib->hdr.len);
937347ac56bfca Martin Schwidefsky 2019-02-25  2163  	ipib = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2164  	if (ipl_secure_flag)
937347ac56bfca Martin Schwidefsky 2019-02-25  2165  		ipib->hdr.flags |= IPL_PL_FLAG_SIPL;
937347ac56bfca Martin Schwidefsky 2019-02-25  2166  	ipib->hdr.flags |= IPL_PL_FLAG_IPLSR;
937347ac56bfca Martin Schwidefsky 2019-02-25  2167  	ptr += report->ipib->hdr.len;
937347ac56bfca Martin Schwidefsky 2019-02-25  2168  	ptr = PTR_ALIGN(ptr, 8);
937347ac56bfca Martin Schwidefsky 2019-02-25  2169  
937347ac56bfca Martin Schwidefsky 2019-02-25  2170  	rl_hdr = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2171  	ptr += sizeof(*rl_hdr);
937347ac56bfca Martin Schwidefsky 2019-02-25  2172  
937347ac56bfca Martin Schwidefsky 2019-02-25  2173  	comps = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2174  	comps->rbt = IPL_RBT_COMPONENTS;
937347ac56bfca Martin Schwidefsky 2019-02-25  2175  	ptr += sizeof(*comps);
937347ac56bfca Martin Schwidefsky 2019-02-25  2176  	list_for_each_entry(comp, &report->components, list) {
937347ac56bfca Martin Schwidefsky 2019-02-25  2177  		memcpy(ptr, &comp->entry, sizeof(comp->entry));
937347ac56bfca Martin Schwidefsky 2019-02-25  2178  		ptr += sizeof(comp->entry);
937347ac56bfca Martin Schwidefsky 2019-02-25  2179  	}
937347ac56bfca Martin Schwidefsky 2019-02-25  2180  	comps->len = ptr - (void *)comps;
937347ac56bfca Martin Schwidefsky 2019-02-25  2181  
937347ac56bfca Martin Schwidefsky 2019-02-25  2182  	certs = ptr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2183  	certs->rbt = IPL_RBT_CERTIFICATES;
937347ac56bfca Martin Schwidefsky 2019-02-25  2184  	ptr += sizeof(*certs);
937347ac56bfca Martin Schwidefsky 2019-02-25  2185  	list_for_each_entry(cert, &report->certificates, list) {
937347ac56bfca Martin Schwidefsky 2019-02-25  2186  		memcpy(ptr, &cert->entry, sizeof(cert->entry));
937347ac56bfca Martin Schwidefsky 2019-02-25  2187  		ptr += sizeof(cert->entry);
937347ac56bfca Martin Schwidefsky 2019-02-25  2188  	}
937347ac56bfca Martin Schwidefsky 2019-02-25  2189  	certs->len = ptr - (void *)certs;
937347ac56bfca Martin Schwidefsky 2019-02-25  2190  	rl_hdr->len = ptr - (void *)rl_hdr;
937347ac56bfca Martin Schwidefsky 2019-02-25  2191  
937347ac56bfca Martin Schwidefsky 2019-02-25  2192  	list_for_each_entry(cert, &report->certificates, list) {
937347ac56bfca Martin Schwidefsky 2019-02-25  2193  		memcpy(ptr, cert->key, cert->entry.len);
937347ac56bfca Martin Schwidefsky 2019-02-25  2194  		ptr += cert->entry.len;
937347ac56bfca Martin Schwidefsky 2019-02-25  2195  	}
937347ac56bfca Martin Schwidefsky 2019-02-25  2196  
937347ac56bfca Martin Schwidefsky 2019-02-25  2197  	BUG_ON(ptr > buf + report->size);
27ed543b2d76a1 Baoquan He         2021-11-16  2198  	*ipl_buf = buf;
27ed543b2d76a1 Baoquan He         2021-11-16  2199  
27ed543b2d76a1 Baoquan He         2021-11-16  2200  	return 0;
937347ac56bfca Martin Schwidefsky 2019-02-25  2201  }
937347ac56bfca Martin Schwidefsky 2019-02-25  2202  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org