linux-kernel - Re: mainline build failure due to 281d0c962752 ("fortify: Add Clang support")

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YrM8kC5zXzZgL/ca@debian>
Date:   Wed, 22 Jun 2022 17:00:16 +0100
From:   Sudip Mukherjee <sudipm.mukherjee@...il.com>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Nathan Chancellor <nathan@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Netdev <netdev@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: mainline build failure due to 281d0c962752 ("fortify: Add Clang
 support")

On Wed, Jun 22, 2022 at 10:19:31AM -0500, Linus Torvalds wrote:
> On Wed, Jun 22, 2022 at 10:08 AM Sudip Mukherjee
> <sudipm.mukherjee@...il.com> wrote:
> >
> > Yeah, true. I had to check to find out its from the memcpy() in check_image_valid().
> 
> Funky but true - I can reproduce it, and just commenting out that
> memcpy fixes the warning.
> 
> And I see nothing wrong with that code - it's copying a 'struct
> fw_section_info_st' between two other structs that seem to have arrays
> that are appropriately sized.

imho, there is no check for 'i' and it can become more than MAX_FW_TYPE_NUM and
in that case it will overwrite.

This fixes the error for me and I think will also address the concern that
clang is raising.

diff --git a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c
index 60ae8bfc5f69..bc4b3ec15925 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c
@@ -41,7 +41,7 @@ static bool check_image_valid(struct hinic_devlink_priv *priv, const u8 *buf,
                return false;
        }

-       for (i = 0; i < fw_image->fw_info.fw_section_cnt; i++) {
+       for (i = 0; i < fw_image->fw_info.fw_section_cnt && i < MAX_FW_TYPE_NUM; i++) {
                len += fw_image->fw_section_info[i].fw_section_len;
                memcpy(&host_image->image_section_info[i],
                       &fw_image->fw_section_info[i],


--
Regards
Sudip