linux-hardening - Re: [PATCH 5.17-rc1 v2] eeprom: at25: Restore missing allocation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdXzEWN7B122ca279t4RPSSWGL29jzTgMdSoJ+Y56jEQYw@mail.gmail.com>
Date:   Tue, 25 Jan 2022 16:25:39 +0100
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Arnd Bergmann <arnd@...db.de>,
        Jiri Prchal <jiri.prchal@...ignal.cz>,
        Andy Shevchenko <andy.shevchenko@...il.com>,
        Ralph Siemsen <ralph.siemsen@...aro.org>,
        Mark Brown <broonie@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-hardening@...r.kernel.org
Subject: Re: [PATCH 5.17-rc1 v2] eeprom: at25: Restore missing allocation

On Tue, Jan 25, 2022 at 3:20 PM Geert Uytterhoeven <geert@...ux-m68k.org> wrote:
> On Fri, Jan 21, 2022 at 12:33 AM Kees Cook <keescook@...omium.org> wrote:
> > The at25 driver regressed in v5.17-rc1 due to a broken conflict
> > resolution: the allocation of the object was accidentally removed. Restore
> > it.
> >
> > This was found when building under CONFIG_FORTIFY_SOURCE=y and
> > -Warray-bounds, which complained about strncpy() being used against an
> > empty object:
> >
> > In function 'strncpy',
> >     inlined from 'at25_fw_to_chip.constprop' at drivers/misc/eeprom/at25.c:312:2:
> > ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
> >    48 | #define __underlying_strncpy    __builtin_strncpy
> >       |                                 ^
> > ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
> >    59 |         return __underlying_strncpy(p, q, size);
> >       |                ^~~~~~~~~~~~~~~~~~~~
> > In function 'strncpy',
> >     inlined from 'at25_fram_to_chip' at drivers/misc/eeprom/at25.c:373:2,
> >     inlined from 'at25_probe' at drivers/misc/eeprom/at25.c:453:10:
> > ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
> >    48 | #define __underlying_strncpy    __builtin_strncpy
> >       |                                 ^
> > ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
> >    59 |         return __underlying_strncpy(p, q, size);
> >       |                ^~~~~~~~~~~~~~~~~~~~
>
> On real hardware:
>
>     Unable to handle kernel access to user memory outside uaccess
> routines at virtual address 0000000000000028
>     ...
>     pc : __mutex_init+0x20/0x68
>     lr : at25_probe+0x8c/0x4d8

To avoid confusion: of course the crash happens only without Kees'
patch.  I just wanted to point out what happens when you boot on
real hardware, as it might be worthwhile to add that to the commit
description.

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds