linux-kernel - include/linux/fortify-string.h:586:17: error: call to '__write_overflow' declared with attribute error: detected write beyond size of object (1st parameter)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 23 Feb 2024 04:33:29 +0800
From: kernel test robot <lkp@...el.com>
To: Ronnie Sahlberg <lsahlber@...hat.com>
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
	Steve French <stfrench@...rosoft.com>,
	"Paulo Alcantara (SUSE)" <pc@....nz>
Subject: include/linux/fortify-string.h:586:17: error: call to
 '__write_overflow' declared with attribute error: detected write beyond size
 of object (1st parameter)

Hi Ronnie,

FYI, the error/warning still remains.

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   39133352cbed6626956d38ed72012f49b0421e7b
commit: 2f6f19c7aaad5005dc75298a413eb0243c5d312d cifs: fix regression in very old smb1 mounts
date:   1 year, 4 months ago
config: mips-allyesconfig (https://download.01.org/0day-ci/archive/20240223/202402230419.nO2R7P95-lkp@intel.com/config)
compiler: mips-linux-gcc (GCC) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240223/202402230419.nO2R7P95-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202402230419.nO2R7P95-lkp@intel.com/

All errors (new ones prefixed by >>):

   In file included from include/linux/string.h:253,
                    from include/linux/bitmap.h:11,
                    from include/linux/cpumask.h:12,
                    from arch/mips/include/asm/processor.h:15,
                    from arch/mips/include/asm/thread_info.h:16,
                    from include/linux/thread_info.h:60,
                    from include/asm-generic/preempt.h:5,
                    from ./arch/mips/include/generated/asm/preempt.h:1,
                    from include/linux/preempt.h:78,
                    from include/linux/spinlock.h:56,
                    from include/linux/wait.h:9,
                    from include/linux/wait_bit.h:8,
                    from include/linux/fs.h:6,
                    from fs/cifs/connect.c:8:
   In function 'strcpy',
       inlined from 'CIFSTCon' at fs/cifs/connect.c:3949:3:
>> include/linux/fortify-string.h:586:17: error: call to '__write_overflow' declared with attribute error: detected write beyond size of object (1st parameter)
     586 |                 __write_overflow();
         |                 ^~~~~~~~~~~~~~~~~~


vim +/__write_overflow +586 include/linux/fortify-string.h

a28a6e860c6cf2 Francis Laniel 2021-02-25  569  
f68f2ff91512c1 Kees Cook      2021-04-20  570  /* Defined after fortified strlen to reuse it. */
92df138a8d663c Kees Cook      2022-02-08  571  __FORTIFY_INLINE __diagnose_as(__builtin_strcpy, 1, 2)
281d0c962752fb Kees Cook      2022-02-08  572  char *strcpy(char * const POS p, const char * const POS q)
a28a6e860c6cf2 Francis Laniel 2021-02-25  573  {
9f7d69c5cd2390 Kees Cook      2022-09-19  574  	size_t p_size = __member_size(p);
9f7d69c5cd2390 Kees Cook      2022-09-19  575  	size_t q_size = __member_size(q);
a28a6e860c6cf2 Francis Laniel 2021-02-25  576  	size_t size;
a28a6e860c6cf2 Francis Laniel 2021-02-25  577  
f68f2ff91512c1 Kees Cook      2021-04-20  578  	/* If neither buffer size is known, immediately give up. */
fa35198f39571b Kees Cook      2022-09-19  579  	if (__builtin_constant_p(p_size) &&
fa35198f39571b Kees Cook      2022-09-19  580  	    __builtin_constant_p(q_size) &&
fa35198f39571b Kees Cook      2022-09-19  581  	    p_size == SIZE_MAX && q_size == SIZE_MAX)
a28a6e860c6cf2 Francis Laniel 2021-02-25  582  		return __underlying_strcpy(p, q);
a28a6e860c6cf2 Francis Laniel 2021-02-25  583  	size = strlen(q) + 1;
072af0c638dc8a Kees Cook      2021-08-02  584  	/* Compile-time check for const size overflow. */
fa35198f39571b Kees Cook      2022-09-19  585  	if (__compiletime_lessthan(p_size, size))
072af0c638dc8a Kees Cook      2021-08-02 @586  		__write_overflow();
072af0c638dc8a Kees Cook      2021-08-02  587  	/* Run-time check for dynamic size overflow. */
a28a6e860c6cf2 Francis Laniel 2021-02-25  588  	if (p_size < size)
a28a6e860c6cf2 Francis Laniel 2021-02-25  589  		fortify_panic(__func__);
f68f2ff91512c1 Kees Cook      2021-04-20  590  	__underlying_memcpy(p, q, size);
a28a6e860c6cf2 Francis Laniel 2021-02-25  591  	return p;
a28a6e860c6cf2 Francis Laniel 2021-02-25  592  }
a28a6e860c6cf2 Francis Laniel 2021-02-25  593  

:::::: The code at line 586 was first introduced by commit
:::::: 072af0c638dc8a5c7db2edc4dddbd6d44bee3bdb fortify: Fix dropped strcpy() compile-time write overflow check

:::::: TO: Kees Cook <keescook@...omium.org>
:::::: CC: Kees Cook <keescook@...omium.org>

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki