lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue, 25 Jan 2022 15:20:38 +0100 From: Geert Uytterhoeven <geert@...ux-m68k.org> To: Kees Cook <keescook@...omium.org> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Arnd Bergmann <arnd@...db.de>, Jiri Prchal <jiri.prchal@...ignal.cz>, Andy Shevchenko <andy.shevchenko@...il.com>, Ralph Siemsen <ralph.siemsen@...aro.org>, Mark Brown <broonie@...nel.org>, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, linux-hardening@...r.kernel.org Subject: Re: [PATCH 5.17-rc1 v2] eeprom: at25: Restore missing allocation Hi Kees, Thanks for your patch! On Fri, Jan 21, 2022 at 12:33 AM Kees Cook <keescook@...omium.org> wrote: > The at25 driver regressed in v5.17-rc1 due to a broken conflict > resolution: the allocation of the object was accidentally removed. Restore > it. > > This was found when building under CONFIG_FORTIFY_SOURCE=y and > -Warray-bounds, which complained about strncpy() being used against an > empty object: > > In function 'strncpy', > inlined from 'at25_fw_to_chip.constprop' at drivers/misc/eeprom/at25.c:312:2: > ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds] > 48 | #define __underlying_strncpy __builtin_strncpy > | ^ > ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy' > 59 | return __underlying_strncpy(p, q, size); > | ^~~~~~~~~~~~~~~~~~~~ > In function 'strncpy', > inlined from 'at25_fram_to_chip' at drivers/misc/eeprom/at25.c:373:2, > inlined from 'at25_probe' at drivers/misc/eeprom/at25.c:453:10: > ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds] > 48 | #define __underlying_strncpy __builtin_strncpy > | ^ > ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy' > 59 | return __underlying_strncpy(p, q, size); > | ^~~~~~~~~~~~~~~~~~~~ On real hardware: Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000028 ... pc : __mutex_init+0x20/0x68 lr : at25_probe+0x8c/0x4d8 > Signed-off-by: Kees Cook <keescook@...omium.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@...der.be> Tested-by: Geert Uytterhoeven <geert+renesas@...der.be> Gr{oetje,eeting}s, Geert -- Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org In personal conversations with technical people, I call myself a hacker. But when I'm talking to journalists I just say "programmer" or something like that. -- Linus Torvalds
Powered by blists - more mailing lists