linux-kernel - Re: [PATCH] gpio: 74x164: Fix crash during .remove()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACRpkdZAVhxF5HJhx0nBqeiinCJPzGQ3q8sGyripO11bVWJXyQ@mail.gmail.com>
Date:   Thu, 30 Nov 2017 15:32:00 +0100
From:   Linus Walleij <linus.walleij@...aro.org>
To:     Geert Uytterhoeven <geert+renesas@...der.be>
Cc:     Fabio Estevam <fabio.estevam@....com>, linux-gpio@...r.kernel.org,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] gpio: 74x164: Fix crash during .remove()

On Tue, Nov 21, 2017 at 3:18 PM, Geert Uytterhoeven
<geert+renesas@...der.be> wrote:

> Commit 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios'
> property") added a new member gpiod_oe to the end of the struct
> gen_74x164_chip, after the zero-length buffer array.
>
> However, this buffer is a flexible array, allocated together with the
> structure during .probe().  As the buffer is no longer the last member,
> writing to it corrupts the newly added member after it.
> During device removal, the corrupted member will be used as a pointer,
> leading to a crash.
>
> This went unnoticed, as the flexible array was declared as "buffer[0]"
> instead of "buffer[]", and thus did not trigger a "flexible array member
> not at end of struct" error from gcc.
>
> Move the gpiod_oe field up to fix this, and drop the zero from the array
> size to prevent future similar bugs.
>
> Fixes: 7ebc194d0fd4bb0f ("gpio: 74x164: Introduce 'enable-gpios' property")
> Signed-off-by: Geert Uytterhoeven <geert+renesas@...der.be>

Patch applied for fixes with Fabio's ACK.

Yours,
Linus Walleij