lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <202310091252.660CFA9@keescook> Date: Mon, 9 Oct 2023 12:52:57 -0700 From: Kees Cook <keescook@...omium.org> To: "Gustavo A. R. Silva" <gustavoars@...nel.org> Cc: Stanimir Varbanov <stanimir.k.varbanov@...il.com>, Vikash Garodia <quic_vgarodia@...cinc.com>, Bryan O'Donoghue <bryan.odonoghue@...aro.org>, Andy Gross <agross@...nel.org>, Bjorn Andersson <andersson@...nel.org>, Konrad Dybcio <konrad.dybcio@...aro.org>, Mauro Carvalho Chehab <mchehab@...nel.org>, linux-media@...r.kernel.org, linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Subject: Re: [PATCH][next] media: venus: hfi_cmds: Replace one-element array with flex-array member and use __counted_by On Mon, Oct 09, 2023 at 12:42:05PM -0600, Gustavo A. R. Silva wrote: > Array `data` in `struct hfi_sfr` is being used as a fake flexible array > at run-time: > > drivers/media/platform/qcom/venus/hfi_venus.c: > 1033 p = memchr(sfr->data, '\0', sfr->buf_size); > 1034 /* > 1035 * SFR isn't guaranteed to be NULL terminated since SYS_ERROR indicates > 1036 * that Venus is in the process of crashing. > 1037 */ > 1038 if (!p) > 1039 sfr->data[sfr->buf_size - 1] = '\0'; > 1040 > 1041 dev_err_ratelimited(dev, "SFR message from FW: %s\n", sfr->data); > > Fake flexible arrays are deprecated, and should be replaced by > flexible-array members. So, replace one-element array with a > flexible-array member in `struct hfi_sfr`. > > While there, also annotate array `data` with __counted_by() to prepare > for the coming implementation by GCC and Clang of the __counted_by > attribute. Flexible array members annotated with __counted_by can have > their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for > array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family > functions). > > This results in no differences in binary output. Thanks for checking! > > This issue was found with the help of Coccinelle, and audited and fixed > manually. > > Signed-off-by: Gustavo A. R. Silva <gustavoars@...nel.org> Reviewed-by: Kees Cook <keescook@...omium.org> -- Kees Cook
Powered by blists - more mailing lists