linux-kernel - Re: [PATCH 05/12] firmware: dmi-id: add a release callback function

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240329161208.GA279061@dev-arch.thelio-3990X>
Date: Fri, 29 Mar 2024 09:12:08 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: Jean Delvare <jdelvare@...e.de>
Cc: Arnd Bergmann <arnd@...nel.org>, linux-kbuild@...r.kernel.org,
	Masahiro Yamada <masahiroy@...nel.org>,
	Greg Kroah-Hartman <gregkh@...e.de>,
	Nicolas Schier <nicolas@...sle.eu>, Arnd Bergmann <arnd@...db.de>,
	Nick Desaulniers <ndesaulniers@...gle.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>, linux-kernel@...r.kernel.org,
	llvm@...ts.linux.dev
Subject: Re: [PATCH 05/12] firmware: dmi-id: add a release callback function

On Fri, Mar 29, 2024 at 01:49:17PM +0100, Jean Delvare wrote:
> Hi Arnd,
> 
> On Tue, 26 Mar 2024 15:51:30 +0100, Arnd Bergmann wrote:
> > From: Arnd Bergmann <arnd@...db.de>
> > 
> > dmi_class uses kfree() as the .release function, but that now causes
> > a warning with clang-16 as it violates control flow integrity (KCFI)
> > rules:
> > 
> > drivers/firmware/dmi-id.c:174:17: error: cast from 'void (*)(const void *)' to 'void (*)(struct device *)' converts to incompatible function type [-Werror,-Wcast-function-type-strict]
> >   174 |         .dev_release = (void(*)(struct device *)) kfree,
> > 
> > Add an explicit function to call kfree() instead.
> > 
> > Fixes: 4f5c791a850e ("DMI-based module autoloading")
> 
> Not sure if this fixes tag is really warranted. As I understand it,
> your change only removes a warning but there was no actual bug, right?

Sort of, the warning is really pointing out that calling this callback
will result in a crash at runtime when the kernel is built with kCFI
enabled, which I would consider a bug.

Cheers,
Nathan