linux-kernel - Re: [PATCH] driver core: platform: use the correct callback type for bus_find

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 12 Nov 2019 14:33:03 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Sami Tolvanen <samitolvanen@...gle.com>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>,
        Suzuki K Poulose <suzuki.poulose@....com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] driver core: platform: use the correct callback type for
 bus_find_device

On Tue, Nov 12, 2019 at 01:41:56PM -0800, Sami Tolvanen wrote:
> platform_find_device_by_driver calls bus_find_device and passes
> platform_match as the callback function. Casting the function to a
> mismatching type trips indirect call Control-Flow Integrity (CFI) checking.

Specifically, the mismatch is between these two places:

struct device *bus_find_device(struct bus_type *bus,
                               struct device *start, const void *data,
                               int (*match)(struct device *dev, const void *data))

struct bus_type {
	...
        int (*match)(struct device *dev, struct device_driver *drv);

against the function itself, which needs to match the prototype for the
initializer assignment:

static int platform_match(struct device *dev, struct device_driver *drv)

I'm surprised this is the only place in the kernel where this happens,
but a grep for other bus_find_device() users shows that they don't also
have struct bus_type helpers; everything else uses the "const void
*data" second argument.

> This change adds a callback function with the correct type and instead
> of casting the function, explicitly casts the second parameter to struct
> device_driver* as expected by platform_match.
> 
> Fixes: 36f3313d6bff9 ("platform: Add platform_find_device_by_driver() helper")
> Signed-off-by: Sami Tolvanen <samitolvanen@...gle.com>
> ---
>  drivers/base/platform.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> index b230beb6ccb4..3c0cd20925b7 100644
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -1278,6 +1278,11 @@ struct bus_type platform_bus_type = {
>  };
>  EXPORT_SYMBOL_GPL(platform_bus_type);
>  
> +static inline int __platform_match(struct device *dev, const void *drv)
> +{
> +	return platform_match(dev, (struct device_driver *)drv);
> +}
> +

So, this makes sense to me. :)

Reviewed-by: Kees Cook <keescook@...omium.org>

-Kees

>  /**
>   * platform_find_device_by_driver - Find a platform device with a given
>   * driver.
> @@ -1288,7 +1293,7 @@ struct device *platform_find_device_by_driver(struct device *start,
>  					      const struct device_driver *drv)
>  {
>  	return bus_find_device(&platform_bus_type, start, drv,
> -			       (void *)platform_match);
> +			       __platform_match);
>  }
>  EXPORT_SYMBOL_GPL(platform_find_device_by_driver);
>  
> 
> base-commit: 100d46bd72ec689a5582c2f5f4deadc5bcb92d60
> -- 
> 2.24.0.rc1.363.gb1bccd3e3d-goog
> 

-- 
Kees Cook