[HSA, PATCH] Allocate memory for shadow arg (PR hsa/70337)

[HSA, PATCH] Allocate memory for shadow arg (PR hsa/70337)

[Martin Liška]

[-- Attachment #1: Type: text/plain, Size: 171 bytes --]

Hello.

Following patch fixes an invalid write in HSA plug-in.
I've been running bootstrap and regression tests on x86-linux-gnu.

Ready after it finishes?
Thanks,
Martin

[-- Attachment #2: 0001-Allocate-memory-for-shadow-arg-PR-hsa-70337.patch --]
[-- Type: text/x-patch, Size: 1314 bytes --]

From 2674ceb5fddeaeb26ff87d26a43bddaf40060ea2 Mon Sep 17 00:00:00 2001
From: marxin <mliska@suse.cz>
Date: Mon, 21 Mar 2016 13:34:04 +0100
Subject: [PATCH] Allocate memory for shadow arg (PR hsa/70337)

libgomp/ChangeLog:

2016-03-21  Martin Liska  <mliska@suse.cz>

	PR hsa/70337
	* plugin/plugin-hsa.c (create_single_kernel_dispatch): Allocate
	memory for hsa_kernel_runtime * argument.
---
 libgomp/plugin/plugin-hsa.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/libgomp/plugin/plugin-hsa.c b/libgomp/plugin/plugin-hsa.c
index d888493..36b3cf4 100644
--- a/libgomp/plugin/plugin-hsa.c
+++ b/libgomp/plugin/plugin-hsa.c
@@ -884,9 +884,10 @@ create_single_kernel_dispatch (struct kernel_info *kernel,
   shadow->private_segment_size = kernel->private_segment_size;
   shadow->group_segment_size = kernel->group_segment_size;
 
-  status
-    = hsa_memory_allocate (agent->kernarg_region, kernel->kernarg_segment_size,
-			   &shadow->kernarg_address);
+  size_t kernarg_size = kernel->kernarg_segment_size
+    + sizeof (struct hsa_kernel_runtime *);
+  status = hsa_memory_allocate (agent->kernarg_region, kernarg_size,
+				&shadow->kernarg_address);
   if (status != HSA_STATUS_SUCCESS)
     hsa_fatal ("Could not allocate memory for HSA kernel arguments", status);
 
-- 
2.7.1

Re: [HSA, PATCH] Allocate memory for shadow arg (PR hsa/70337)

[Martin Jambor]

Hi,

On Mon, Mar 21, 2016 at 01:49:25PM +0100, Martin Liska wrote:
> Hello.
> 
> Following patch fixes an invalid write in HSA plug-in.
> I've been running bootstrap and regression tests on x86-linux-gnu.
> 
> Ready after it finishes?
> Thanks,
> Martin

> From 2674ceb5fddeaeb26ff87d26a43bddaf40060ea2 Mon Sep 17 00:00:00 2001
> From: marxin <mliska@suse.cz>
> Date: Mon, 21 Mar 2016 13:34:04 +0100
> Subject: [PATCH] Allocate memory for shadow arg (PR hsa/70337)
> 
> libgomp/ChangeLog:
> 
> 2016-03-21  Martin Liska  <mliska@suse.cz>
> 
> 	PR hsa/70337
> 	* plugin/plugin-hsa.c (create_single_kernel_dispatch): Allocate
> 	memory for hsa_kernel_runtime * argument.
> ---
>  libgomp/plugin/plugin-hsa.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
> 
> diff --git a/libgomp/plugin/plugin-hsa.c b/libgomp/plugin/plugin-hsa.c
> index d888493..36b3cf4 100644
> --- a/libgomp/plugin/plugin-hsa.c
> +++ b/libgomp/plugin/plugin-hsa.c
> @@ -884,9 +884,10 @@ create_single_kernel_dispatch (struct kernel_info *kernel,
>    shadow->private_segment_size = kernel->private_segment_size;
>    shadow->group_segment_size = kernel->group_segment_size;
>  
> -  status
> -    = hsa_memory_allocate (agent->kernarg_region, kernel->kernarg_segment_size,
> -			   &shadow->kernarg_address);
> +  size_t kernarg_size = kernel->kernarg_segment_size
> +    + sizeof (struct hsa_kernel_runtime *);

This is strange.  The pointer to the shadow data structure is, from
the HSA perspective, a normal kernel argument and therefore should
already be included in the kernel->kernarg_segment_size.  Have you
checked that the values are indeed off?

Martin


> +  status = hsa_memory_allocate (agent->kernarg_region, kernarg_size,
> +				&shadow->kernarg_address);
>    if (status != HSA_STATUS_SUCCESS)
>      hsa_fatal ("Could not allocate memory for HSA kernel arguments", status);
>  
> -- 
> 2.7.1
> 

Re: [HSA, PATCH] Allocate memory for shadow arg (PR hsa/70337)

[Martin Liška]

[-- Attachment #1: Type: text/plain, Size: 521 bytes --]

On 03/21/2016 07:23 PM, Martin Jambor wrote:
> This is strange.  The pointer to the shadow data structure is, from
> the HSA perspective, a normal kernel argument and therefore should
> already be included in the kernel->kernarg_segment_size.  Have you
> checked that the values are indeed off?

Hi Martin.

You are right that size of a shadow argument pointer should be
included in the kernel->kernarg_segment_size. I've been currently
testing a proper patch which conditionally copies shadow argument.

Thanks,
Martin


[-- Attachment #2: 0001-Copy-shadow-argument-conditionally-PR-hsa-70337.patch --]
[-- Type: text/x-patch, Size: 1445 bytes --]

From 413707c51bf4b0ac7f8dac6421be9955c18767dd Mon Sep 17 00:00:00 2001
From: marxin <mliska@suse.cz>
Date: Mon, 21 Mar 2016 21:40:03 +0100
Subject: [PATCH] Copy shadow argument conditionally (PR hsa/70337)

libgomp/ChangeLog:

2016-03-21  Martin Liska  <mliska@suse.cz>

	PR hsa/70337
	* plugin/plugin-hsa.c (GOMP_OFFLOAD_run): Copy shadow
	argument just in case a dispatched kernel uses that argument.
---
 libgomp/plugin/plugin-hsa.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/libgomp/plugin/plugin-hsa.c b/libgomp/plugin/plugin-hsa.c
index d888493..f7ef600 100644
--- a/libgomp/plugin/plugin-hsa.c
+++ b/libgomp/plugin/plugin-hsa.c
@@ -1255,8 +1255,16 @@ GOMP_OFFLOAD_run (int n, void *fn_ptr, void *vars, void **args)
   hsa_signal_store_relaxed (s, 1);
   memcpy (shadow->kernarg_address, &vars, sizeof (vars));
 
-  memcpy (shadow->kernarg_address + sizeof (vars), &shadow,
-	  sizeof (struct hsa_kernel_runtime *));
+  /* PR hsa/70337.  */
+  size_t vars_size = sizeof (vars);
+  if (kernel->kernarg_segment_size > vars_size)
+    {
+      if (kernel->kernarg_segment_size != vars_size
+	  + sizeof (struct hsa_kernel_runtime *))
+	GOMP_PLUGIN_fatal ("Kernel segment size has an unexpected value");
+      memcpy (packet->kernarg_address + vars_size, &shadow,
+	      sizeof (struct hsa_kernel_runtime *));
+    }
 
   HSA_DEBUG ("Copying kernel runtime pointer to kernarg_address\n");
 
-- 
2.7.1

Re: [HSA, PATCH] Allocate memory for shadow arg (PR hsa/70337)

[Martin Jambor]

On Mon, Mar 21, 2016 at 09:51:27PM +0100, Martin Liska wrote:
> On 03/21/2016 07:23 PM, Martin Jambor wrote:
> >This is strange.  The pointer to the shadow data structure is, from
> >the HSA perspective, a normal kernel argument and therefore should
> >already be included in the kernel->kernarg_segment_size.  Have you
> >checked that the values are indeed off?
> 
> Hi Martin.
> 
> You are right that size of a shadow argument pointer should be
> included in the kernel->kernarg_segment_size. I've been currently
> testing a proper patch which conditionally copies shadow argument.
> 
> Thanks,
> Martin
> 

> From 413707c51bf4b0ac7f8dac6421be9955c18767dd Mon Sep 17 00:00:00 2001
> From: marxin <mliska@suse.cz>
> Date: Mon, 21 Mar 2016 21:40:03 +0100
> Subject: [PATCH] Copy shadow argument conditionally (PR hsa/70337)
> 
> libgomp/ChangeLog:
> 
> 2016-03-21  Martin Liska  <mliska@suse.cz>
> 
> 	PR hsa/70337
> 	* plugin/plugin-hsa.c (GOMP_OFFLOAD_run): Copy shadow
> 	argument just in case a dispatched kernel uses that argument.

This is OK, thanks,

Martin

> ---
>  libgomp/plugin/plugin-hsa.c | 12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/libgomp/plugin/plugin-hsa.c b/libgomp/plugin/plugin-hsa.c
> index d888493..f7ef600 100644
> --- a/libgomp/plugin/plugin-hsa.c
> +++ b/libgomp/plugin/plugin-hsa.c
> @@ -1255,8 +1255,16 @@ GOMP_OFFLOAD_run (int n, void *fn_ptr, void *vars, void **args)
>    hsa_signal_store_relaxed (s, 1);
>    memcpy (shadow->kernarg_address, &vars, sizeof (vars));
>  
> -  memcpy (shadow->kernarg_address + sizeof (vars), &shadow,
> -	  sizeof (struct hsa_kernel_runtime *));
> +  /* PR hsa/70337.  */
> +  size_t vars_size = sizeof (vars);
> +  if (kernel->kernarg_segment_size > vars_size)
> +    {
> +      if (kernel->kernarg_segment_size != vars_size
> +	  + sizeof (struct hsa_kernel_runtime *))
> +	GOMP_PLUGIN_fatal ("Kernel segment size has an unexpected value");
> +      memcpy (packet->kernarg_address + vars_size, &shadow,
> +	      sizeof (struct hsa_kernel_runtime *));
> +    }
>  
>    HSA_DEBUG ("Copying kernel runtime pointer to kernarg_address\n");
>  
> -- 
> 2.7.1
>