linux-kernel - [PATCH] of: Prevent unaligned access in of_alias

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 23 Sep 2016 16:38:27 +0100
From:   Paul Burton <paul.burton@...tec.com>
To:     <linux-mips@...ux-mips.org>
CC:     Paul Burton <paul.burton@...tec.com>, <devicetree@...r.kernel.org>,
        Rob Herring <robh+dt@...nel.org>,
        Frank Rowand <frowand.list@...il.com>,
        <linux-kernel@...r.kernel.org>, Ralf Baechle <ralf@...ux-mips.org>
Subject: [PATCH] of: Prevent unaligned access in of_alias_scan()

When allocating a struct alias_prop, of_alias_scan() only requested that
it be aligned on a 4 byte boundary. The struct contains pointers which
leads to us attempting 64 bit writes on 64 bit systems, and if the CPU
doesn't support unaligned memory accesses then this causes problems -
for example on some MIPS64r2 CPUs including the "mips64r2-generic" QEMU
emulated CPU it will trigger an address error exception.

Fix this by requesting alignment for the struct alias_prop allocation
matching that which the compiler expects, using the __alignof__ keyword.

Signed-off-by: Paul Burton <paul.burton@...tec.com>
Cc: devicetree@...r.kernel.org
Cc: Rob Herring <robh+dt@...nel.org>
Cc: Frank Rowand <frowand.list@...il.com>
Cc: linux-kernel@...r.kernel.org
Cc: linux-mips@...ux-mips.org
Cc: Ralf Baechle <ralf@...ux-mips.org>
---
 drivers/of/base.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 3ce6953..448aa40 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -2042,7 +2042,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
 			continue;

 		/* Allocate an alias_prop with enough space for the stem */
-		ap = dt_alloc(sizeof(*ap) + len + 1, 4);
+		ap = dt_alloc(sizeof(*ap) + len + 1, __alignof__(*ap));
 		if (!ap)
 			continue;
 		memset(ap, 0, sizeof(*ap) + len + 1);
-- 
2.10.0