| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202109180115.pHpBkqvV-lkp@intel.com>
Date: Sat, 18 Sep 2021 01:54:32 +0800
From: kernel test robot <lkp@...el.com>
To: Mark Rutland <mark.rutland@....com>
Cc: kbuild-all@...ts.01.org, linux-kernel@...r.kernel.org
Subject: [mark:arm64/kcsan 12/13]
drivers/char/ipmi/ipmi_msghandler.c:5049:17: warning: 'strncpy' specified
bound 11 equals destination size
tree: https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git arm64/kcsan
head: 4fe9d6c2ef85257d80291086e4514eaaebd3504e
commit: 2d67c39ae4f619ca94d9790e09186e77922fa826 [12/13] arm64: enable KCSAN support
config: arm64-buildonly-randconfig-r001-20210917 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git/commit/?id=2d67c39ae4f619ca94d9790e09186e77922fa826
git remote add mark https://git.kernel.org/pub/scm/linux/kernel/git/mark/linux.git
git fetch --no-tags mark arm64/kcsan
git checkout 2d67c39ae4f619ca94d9790e09186e77922fa826
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross ARCH=arm64
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>
All warnings (new ones prefixed by >>):
drivers/char/ipmi/ipmi_msghandler.c: In function 'send_panic_events':
>> drivers/char/ipmi/ipmi_msghandler.c:5049:17: warning: 'strncpy' specified bound 11 equals destination size [-Wstringop-truncation]
5049 | strncpy(data+5, p, 11);
| ^~~~~~~~~~~~~~~~~~~~~~
--
drivers/gpu/drm/drm_modes.c: In function 'drm_mode_convert_to_umode':
>> drivers/gpu/drm/drm_modes.c:1938:9: warning: 'strncpy' output may be truncated copying 31 bytes from a string of length 31 [-Wstringop-truncation]
1938 | strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/drm_modes.c: In function 'drm_mode_convert_umode':
drivers/gpu/drm/drm_modes.c:1980:9: warning: 'strncpy' output may be truncated copying 31 bytes from a string of length 31 [-Wstringop-truncation]
1980 | strncpy(out->name, in->name, DRM_DISPLAY_MODE_LEN);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--
drivers/gpu/drm/drm_property.c: In function 'drm_mode_getproperty_ioctl':
>> drivers/gpu/drm/drm_property.c:478:9: warning: 'strncpy' output may be truncated copying 31 bytes from a string of length 31 [-Wstringop-truncation]
478 | strncpy(out_resp->name, property->name, DRM_PROP_NAME_LEN);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +/strncpy +5049 drivers/char/ipmi/ipmi_msghandler.c
^1da177e4c3f41 Linus Torvalds 2005-04-16 4909
a567b6230066e3 Corey Minyard 2018-04-05 4910 static void send_panic_events(struct ipmi_smi *intf, char *str)
^1da177e4c3f41 Linus Torvalds 2005-04-16 4911 {
^1da177e4c3f41 Linus Torvalds 2005-04-16 4912 struct kernel_ipmi_msg msg;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4913 unsigned char data[16];
^1da177e4c3f41 Linus Torvalds 2005-04-16 4914 struct ipmi_system_interface_addr *si;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4915 struct ipmi_addr addr;
91e2dd0a47bae1 Corey Minyard 2018-03-28 4916 char *p = str;
91e2dd0a47bae1 Corey Minyard 2018-03-28 4917 struct ipmi_ipmb_addr *ipmb;
91e2dd0a47bae1 Corey Minyard 2018-03-28 4918 int j;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4919
1c9f98d1bfbd06 Corey Minyard 2017-08-18 4920 if (ipmi_send_panic_event == IPMI_SEND_PANIC_EVENT_NONE)
1c9f98d1bfbd06 Corey Minyard 2017-08-18 4921 return;
1c9f98d1bfbd06 Corey Minyard 2017-08-18 4922
^1da177e4c3f41 Linus Torvalds 2005-04-16 4923 si = (struct ipmi_system_interface_addr *) &addr;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4924 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4925 si->channel = IPMI_BMC_CHANNEL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4926 si->lun = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4927
^1da177e4c3f41 Linus Torvalds 2005-04-16 4928 /* Fill in an event telling that we have failed. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4929 msg.netfn = 0x04; /* Sensor or Event. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4930 msg.cmd = 2; /* Platform event command. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4931 msg.data = data;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4932 msg.data_len = 8;
cda315aba34ff4 Matt Domsch 2005-12-12 4933 data[0] = 0x41; /* Kernel generator ID, IPMI table 5-4 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4934 data[1] = 0x03; /* This is for IPMI 1.0. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4935 data[2] = 0x20; /* OS Critical Stop, IPMI table 36-3 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4936 data[4] = 0x6f; /* Sensor specific, IPMI table 36-1 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4937 data[5] = 0xa1; /* Runtime stop OEM bytes 2 & 3. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4938
c70d749986f6f1 Corey Minyard 2008-04-29 4939 /*
c70d749986f6f1 Corey Minyard 2008-04-29 4940 * Put a few breadcrumbs in. Hopefully later we can add more things
c70d749986f6f1 Corey Minyard 2008-04-29 4941 * to make the panic events more useful.
c70d749986f6f1 Corey Minyard 2008-04-29 4942 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4943 if (str) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 4944 data[3] = str[0];
^1da177e4c3f41 Linus Torvalds 2005-04-16 4945 data[6] = str[1];
^1da177e4c3f41 Linus Torvalds 2005-04-16 4946 data[7] = str[2];
^1da177e4c3f41 Linus Torvalds 2005-04-16 4947 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 4948
^1da177e4c3f41 Linus Torvalds 2005-04-16 4949 /* Send the event announcing the panic. */
895dcfd1cab84d Corey Minyard 2012-03-28 4950 ipmi_panic_request_and_wait(intf, &addr, &msg);
^1da177e4c3f41 Linus Torvalds 2005-04-16 4951
c70d749986f6f1 Corey Minyard 2008-04-29 4952 /*
c70d749986f6f1 Corey Minyard 2008-04-29 4953 * On every interface, dump a bunch of OEM event holding the
c70d749986f6f1 Corey Minyard 2008-04-29 4954 * string.
c70d749986f6f1 Corey Minyard 2008-04-29 4955 */
1c9f98d1bfbd06 Corey Minyard 2017-08-18 4956 if (ipmi_send_panic_event != IPMI_SEND_PANIC_EVENT_STRING || !str)
^1da177e4c3f41 Linus Torvalds 2005-04-16 4957 return;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4958
78ba2faf71c639 Corey Minyard 2007-02-10 4959 /*
78ba2faf71c639 Corey Minyard 2007-02-10 4960 * intf_num is used as an marker to tell if the
78ba2faf71c639 Corey Minyard 2007-02-10 4961 * interface is valid. Thus we need a read barrier to
78ba2faf71c639 Corey Minyard 2007-02-10 4962 * make sure data fetched before checking intf_num
78ba2faf71c639 Corey Minyard 2007-02-10 4963 * won't be used.
78ba2faf71c639 Corey Minyard 2007-02-10 4964 */
78ba2faf71c639 Corey Minyard 2007-02-10 4965 smp_rmb();
78ba2faf71c639 Corey Minyard 2007-02-10 4966
c70d749986f6f1 Corey Minyard 2008-04-29 4967 /*
c70d749986f6f1 Corey Minyard 2008-04-29 4968 * First job here is to figure out where to send the
c70d749986f6f1 Corey Minyard 2008-04-29 4969 * OEM events. There's no way in IPMI to send OEM
c70d749986f6f1 Corey Minyard 2008-04-29 4970 * events using an event send command, so we have to
c70d749986f6f1 Corey Minyard 2008-04-29 4971 * find the SEL to put them in and stick them in
c70d749986f6f1 Corey Minyard 2008-04-29 4972 * there.
c70d749986f6f1 Corey Minyard 2008-04-29 4973 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4974
^1da177e4c3f41 Linus Torvalds 2005-04-16 4975 /* Get capabilities from the get device id. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4976 intf->local_sel_device = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4977 intf->local_event_generator = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4978 intf->event_receiver = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4979
^1da177e4c3f41 Linus Torvalds 2005-04-16 4980 /* Request the device info from the local MC. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4981 msg.netfn = IPMI_NETFN_APP_REQUEST;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4982 msg.cmd = IPMI_GET_DEVICE_ID_CMD;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4983 msg.data = NULL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4984 msg.data_len = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4985 intf->null_user_handler = device_id_fetcher;
895dcfd1cab84d Corey Minyard 2012-03-28 4986 ipmi_panic_request_and_wait(intf, &addr, &msg);
^1da177e4c3f41 Linus Torvalds 2005-04-16 4987
^1da177e4c3f41 Linus Torvalds 2005-04-16 4988 if (intf->local_event_generator) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 4989 /* Request the event receiver from the local MC. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 4990 msg.netfn = IPMI_NETFN_SENSOR_EVENT_REQUEST;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4991 msg.cmd = IPMI_GET_EVENT_RECEIVER_CMD;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4992 msg.data = NULL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4993 msg.data_len = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4994 intf->null_user_handler = event_receiver_fetcher;
895dcfd1cab84d Corey Minyard 2012-03-28 4995 ipmi_panic_request_and_wait(intf, &addr, &msg);
^1da177e4c3f41 Linus Torvalds 2005-04-16 4996 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 4997 intf->null_user_handler = NULL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 4998
c70d749986f6f1 Corey Minyard 2008-04-29 4999 /*
c70d749986f6f1 Corey Minyard 2008-04-29 5000 * Validate the event receiver. The low bit must not
c70d749986f6f1 Corey Minyard 2008-04-29 5001 * be 1 (it must be a valid IPMB address), it cannot
c70d749986f6f1 Corey Minyard 2008-04-29 5002 * be zero, and it must not be my address.
c70d749986f6f1 Corey Minyard 2008-04-29 5003 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 5004 if (((intf->event_receiver & 1) == 0)
^1da177e4c3f41 Linus Torvalds 2005-04-16 5005 && (intf->event_receiver != 0)
5fdb1fb2abe647 Corey Minyard 2017-09-05 5006 && (intf->event_receiver != intf->addrinfo[0].address)) {
c70d749986f6f1 Corey Minyard 2008-04-29 5007 /*
c70d749986f6f1 Corey Minyard 2008-04-29 5008 * The event receiver is valid, send an IPMB
c70d749986f6f1 Corey Minyard 2008-04-29 5009 * message.
c70d749986f6f1 Corey Minyard 2008-04-29 5010 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 5011 ipmb = (struct ipmi_ipmb_addr *) &addr;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5012 ipmb->addr_type = IPMI_IPMB_ADDR_TYPE;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5013 ipmb->channel = 0; /* FIXME - is this right? */
^1da177e4c3f41 Linus Torvalds 2005-04-16 5014 ipmb->lun = intf->event_receiver_lun;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5015 ipmb->slave_addr = intf->event_receiver;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5016 } else if (intf->local_sel_device) {
c70d749986f6f1 Corey Minyard 2008-04-29 5017 /*
c70d749986f6f1 Corey Minyard 2008-04-29 5018 * The event receiver was not valid (or was
c70d749986f6f1 Corey Minyard 2008-04-29 5019 * me), but I am an SEL device, just dump it
c70d749986f6f1 Corey Minyard 2008-04-29 5020 * in my SEL.
c70d749986f6f1 Corey Minyard 2008-04-29 5021 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 5022 si = (struct ipmi_system_interface_addr *) &addr;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5023 si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5024 si->channel = IPMI_BMC_CHANNEL;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5025 si->lun = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5026 } else
91e2dd0a47bae1 Corey Minyard 2018-03-28 5027 return; /* No where to send the event. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 5028
^1da177e4c3f41 Linus Torvalds 2005-04-16 5029 msg.netfn = IPMI_NETFN_STORAGE_REQUEST; /* Storage. */
^1da177e4c3f41 Linus Torvalds 2005-04-16 5030 msg.cmd = IPMI_ADD_SEL_ENTRY_CMD;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5031 msg.data = data;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5032 msg.data_len = 16;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5033
^1da177e4c3f41 Linus Torvalds 2005-04-16 5034 j = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5035 while (*p) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 5036 int size = strlen(p);
^1da177e4c3f41 Linus Torvalds 2005-04-16 5037
^1da177e4c3f41 Linus Torvalds 2005-04-16 5038 if (size > 11)
^1da177e4c3f41 Linus Torvalds 2005-04-16 5039 size = 11;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5040 data[0] = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5041 data[1] = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5042 data[2] = 0xf0; /* OEM event without timestamp. */
5fdb1fb2abe647 Corey Minyard 2017-09-05 5043 data[3] = intf->addrinfo[0].address;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5044 data[4] = j++; /* sequence # */
c70d749986f6f1 Corey Minyard 2008-04-29 5045 /*
c70d749986f6f1 Corey Minyard 2008-04-29 5046 * Always give 11 bytes, so strncpy will fill
c70d749986f6f1 Corey Minyard 2008-04-29 5047 * it with zeroes for me.
c70d749986f6f1 Corey Minyard 2008-04-29 5048 */
^1da177e4c3f41 Linus Torvalds 2005-04-16 @5049 strncpy(data+5, p, 11);
^1da177e4c3f41 Linus Torvalds 2005-04-16 5050 p += size;
^1da177e4c3f41 Linus Torvalds 2005-04-16 5051
895dcfd1cab84d Corey Minyard 2012-03-28 5052 ipmi_panic_request_and_wait(intf, &addr, &msg);
^1da177e4c3f41 Linus Torvalds 2005-04-16 5053 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 5054 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 5055
:::::: The code at line 5049 was first introduced by commit
:::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2
:::::: TO: Linus Torvalds <torvalds@...970.osdl.org>
:::::: CC: Linus Torvalds <torvalds@...970.osdl.org>
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
Download attachment ".config.gz" of type "application/gzip" (37375 bytes)
Powered by blists - more mailing lists