| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20220825071541.1228110-1-xiaolei.wang@windriver.com>
Date: Thu, 25 Aug 2022 15:15:41 +0800
From: Xiaolei Wang <xiaolei.wang@...driver.com>
To: lgirdwood@...il.com, broonie@...nel.org
Cc: linux-kernel@...r.kernel.org
Subject: [PATCH] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
The pfuze_chip::regulator_descs is an array of size
PFUZE100_MAX_REGULATOR, the pfuze_chip::pfuze_regulators
is the pointer to the real regulators of a specific device.
The number of real regulator is supposed to be less than
the PFUZE100_MAX_REGULATOR, so we should use the size of
'regulator_num * sizeof(struct pfuze_regulator)' in memcpy().
This fixes the out of bounds access bug reported by KASAN.
BUG: KASAN: global-out-of-bounds in pfuze100_regulator_probe+0x380/0x8b8
Read of size 3968 at addr c3390640 by task swapper/0/1
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-yocto-standard+ #2
Hardware name: Freescale i.MX6 SoloX (Device Tree)
unwind_backtrace from show_stack+0x18/0x1c
show_stack from dump_stack_lvl+0x68/0x90
dump_stack_lvl from print_report+0x58/0x4c8
print_report from kasan_report+0x7c/0x98
kasan_report from kasan_check_range+0x20/0x170
kasan_check_range from memcpy+0x28/0x68
memcpy from pfuze100_regulator_probe+0x380/0x8b8
pfuze100_regulator_probe from i2c_device_probe+0x37c/0x39c
i2c_device_probe from really_probe+0x1cc/0x398
really_probe from __driver_probe_device+0x118/0x124
__driver_probe_device from driver_probe_device+0x5c/0xf0
driver_probe_device from __driver_attach+0x144/0x160
__driver_attach from bus_for_each_dev+0xf4/0x12c
bus_for_each_dev from bus_add_driver+0x124/0x264
bus_add_driver from driver_register+0x130/0x188
driver_register from i2c_register_driver+0x80/0xa8
i2c_register_driver from do_one_initcall+0x180/0x39c
do_one_initcall from kernel_init_freeable+0x374/0x3cc
kernel_init_freeable from kernel_init+0x1c/0x150
kernel_init from ret_from_fork+0x14/0x2c
Exception stack(0xf083bfb0 to 0xf083bff8)
bfa0: 00000000 00000000 00000000
bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000
bfe0: 00000000 00000000 00000000 00000000 00000013 00000000
The buggy address belongs to the variable:
pfuze200_regulators+0x0/0xdc0
The buggy address belongs to the physical page:
page:(ptrval) refcount:1 mapcount:0 mapping:00000000 index:0x0
pfn:0x93390
flags: 0x1000(reserved|zone=0)
raw: 00001000 ee9a5044 ee9a5044 00000000 00000000 00000000 ffffffff
raw: 00000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
c3391280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c3391300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>c3391380: 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
^
c3391400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
c3391480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Signed-off-by: Xiaolei Wang <xiaolei.wang@...driver.com>
---
drivers/regulator/pfuze100-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index 6b617024a67d..d899d6e98fb8 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -766,7 +766,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));
memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
- sizeof(pfuze_chip->regulator_descs));
+ regulator_num * sizeof(struct pfuze_regulator));
ret = pfuze_parse_regulators_dt(pfuze_chip);
if (ret)
--
2.25.1
Powered by blists - more mailing lists