• Nathan Lynch's avatar
    powerpc/pseries: Enforce hcall result buffer validity and size · ff2e185c
    Nathan Lynch authored
    plpar_hcall(), plpar_hcall9(), and related functions expect callers to
    provide valid result buffers of certain minimum size. Currently this
    is communicated only through comments in the code and the compiler has
    no idea.
    
    For example, if I write a bug like this:
    
      long retbuf[PLPAR_HCALL_BUFSIZE]; // should be PLPAR_HCALL9_BUFSIZE
      plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf, ...);
    
    This compiles with no diagnostics emitted, but likely results in stack
    corruption at runtime when plpar_hcall9() stores results past the end
    of the array. (To be clear this is a contrived example and I have not
    found a real instance yet.)
    
    To make this class of error less likely, we can use explicitly-sized
    array parameters instead of pointers in the declarations for the hcall
    APIs. When compiled with -Warray-bounds[1], the code above now
    provokes a diagnostic like this:
    
    error: array argument is too small;
    is of size 32, callee requires at least 72 [-Werror,-Warray-bounds]
       60 |                 plpar_hcall9(H_ALLOCATE_VAS_WINDOW, retbuf,
          |                 ^                                   ~~~~~~
    
    [1] Enabled for LLVM builds but not GCC for now. See commit
        0da6e5fd ("gcc: disable '-Warray-bounds' for gcc-13 too") and
        related changes.
    Signed-off-by: default avatarNathan Lynch <nathanl@linux.ibm.com>
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://msgid.link/20240408-pseries-hvcall-retbuf-v1-1-ebc73d7253cf@linux.ibm.com
    ff2e185c
hvcall.h 22.6 KB