lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 15 Jun 2022 22:23:12 -0700 From: Kees Cook <keescook@...omium.org> To: "David S. Miller" <davem@...emloft.net> Cc: Kees Cook <keescook@...omium.org>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>, Tom Rix <trix@...hat.com>, Leon Romanovsky <leon@...nel.org>, Jiri Pirko <jiri@...dia.com>, Vladimir Oltean <olteanv@...il.com>, Simon Horman <simon.horman@...igine.com>, netdev@...r.kernel.org, llvm@...ts.linux.dev, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Subject: [PATCH] hinic: Replace memcpy() with direct assignment Under CONFIG_FORTIFY_SOURCE=y and CONFIG_UBSAN_BOUNDS=y, Clang is bugged here for calculating the size of the destination buffer (0x10 instead of 0x14). This copy is a fixed size (sizeof(struct fw_section_info_st)), with the source and dest being struct fw_section_info_st, so the memcpy should be safe, assuming the index is within bounds, which is UBSAN_BOUNDS's responsibility to figure out. Avoid the whole thing and just do a direct assignment. This results in no change to the executable code. Cc: "David S. Miller" <davem@...emloft.net> Cc: Eric Dumazet <edumazet@...gle.com> Cc: Jakub Kicinski <kuba@...nel.org> Cc: Paolo Abeni <pabeni@...hat.com> Cc: Nathan Chancellor <nathan@...nel.org> Cc: Nick Desaulniers <ndesaulniers@...gle.com> Cc: Tom Rix <trix@...hat.com> Cc: Leon Romanovsky <leon@...nel.org> Cc: Jiri Pirko <jiri@...dia.com> Cc: Vladimir Oltean <olteanv@...il.com> Cc: Simon Horman <simon.horman@...igine.com> Cc: netdev@...r.kernel.org Cc: llvm@...ts.linux.dev Link: https://github.com/ClangBuiltLinux/linux/issues/1592 Signed-off-by: Kees Cook <keescook@...omium.org> --- drivers/net/ethernet/huawei/hinic/hinic_devlink.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c index 60ae8bfc5f69..1749d26f4bef 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c @@ -43,9 +43,7 @@ static bool check_image_valid(struct hinic_devlink_priv *priv, const u8 *buf, for (i = 0; i < fw_image->fw_info.fw_section_cnt; i++) { len += fw_image->fw_section_info[i].fw_section_len; - memcpy(&host_image->image_section_info[i], - &fw_image->fw_section_info[i], - sizeof(struct fw_section_info_st)); + host_image->image_section_info[i] = fw_image->fw_section_info[i]; } if (len != fw_image->fw_len || -- 2.32.0
Powered by blists - more mailing lists