[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMuHMdWu-unMfV1U_HAKwJwPkB_LY3kU88_D69M=bX8y1B=QTg@mail.gmail.com>
Date: Tue, 25 Jan 2022 15:20:38 +0100
From: Geert Uytterhoeven <geert@...ux-m68k.org>
To: Kees Cook <keescook@...omium.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Arnd Bergmann <arnd@...db.de>,
Jiri Prchal <jiri.prchal@...ignal.cz>,
Andy Shevchenko <andy.shevchenko@...il.com>,
Ralph Siemsen <ralph.siemsen@...aro.org>,
Mark Brown <broonie@...nel.org>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
linux-hardening@...r.kernel.org
Subject: Re: [PATCH 5.17-rc1 v2] eeprom: at25: Restore missing allocation
Hi Kees,
Thanks for your patch!
On Fri, Jan 21, 2022 at 12:33 AM Kees Cook <keescook@...omium.org> wrote:
> The at25 driver regressed in v5.17-rc1 due to a broken conflict
> resolution: the allocation of the object was accidentally removed. Restore
> it.
>
> This was found when building under CONFIG_FORTIFY_SOURCE=y and
> -Warray-bounds, which complained about strncpy() being used against an
> empty object:
>
> In function 'strncpy',
> inlined from 'at25_fw_to_chip.constprop' at drivers/misc/eeprom/at25.c:312:2:
> ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
> 48 | #define __underlying_strncpy __builtin_strncpy
> | ^
> ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
> 59 | return __underlying_strncpy(p, q, size);
> | ^~~~~~~~~~~~~~~~~~~~
> In function 'strncpy',
> inlined from 'at25_fram_to_chip' at drivers/misc/eeprom/at25.c:373:2,
> inlined from 'at25_probe' at drivers/misc/eeprom/at25.c:453:10:
> ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
> 48 | #define __underlying_strncpy __builtin_strncpy
> | ^
> ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
> 59 | return __underlying_strncpy(p, q, size);
> | ^~~~~~~~~~~~~~~~~~~~
On real hardware:
Unable to handle kernel access to user memory outside uaccess
routines at virtual address 0000000000000028
...
pc : __mutex_init+0x20/0x68
lr : at25_probe+0x8c/0x4d8
> Signed-off-by: Kees Cook <keescook@...omium.org>
Reviewed-by: Geert Uytterhoeven <geert+renesas@...der.be>
Tested-by: Geert Uytterhoeven <geert+renesas@...der.be>
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
Powered by blists - more mailing lists