linux-kernel - [PATCH] firmware: arm_ffa: Fix warning caused by export

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241014004724.991353-1-gshan@redhat.com>
Date: Mon, 14 Oct 2024 10:47:24 +1000
From: Gavin Shan <gshan@...hat.com>
To: linux-arm-kernel@...ts.infradead.org
Cc: linux-kernel@...r.kernel.org,
	sudeep.holla@....com,
	shan.gavin@...il.com
Subject: [PATCH] firmware: arm_ffa: Fix warning caused by export_uuid()

Run into build warning caused by export_uuid() where the UUID's
length exceeds that of ffa_value_t::a2, as the following warning
messages indicate.

In function ‘fortify_memcpy_chk’,
inlined from ‘export_uuid’ at ./include/linux/uuid.h:88:2,
inlined from ‘ffa_msg_send_direct_req2’ at drivers/firmware/arm_ffa/driver.c:488:2:
./include/linux/fortify-string.h:571:25: error: call to ‘__write_overflow_field’ \
declared with attribute warning: detected write beyond size of field (1st parameter); \
maybe use struct_group()? [-Werror=attribute-warning]
571 |                         __write_overflow_field(p_size_field, size);
    |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix it by not passing a plain buffer to memcpy() to avoid the overflow
and underflow warning, similar to what have been done to copy over the
struct ffa_send_direct_data2.

Fixes: aaef3bc98129 ("firmware: arm_ffa: Add support for FFA_MSG_SEND_DIRECT_{REQ,RESP}2")
Signed-off-by: Gavin Shan <gshan@...hat.com>
---
 drivers/firmware/arm_ffa/driver.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c
index 4d231bc375e0..154777e89f04 100644
--- a/drivers/firmware/arm_ffa/driver.c
+++ b/drivers/firmware/arm_ffa/driver.c
@@ -485,7 +485,7 @@ static int ffa_msg_send_direct_req2(u16 src_id, u16 dst_id, const uuid_t *uuid,
 		.a0 = FFA_MSG_SEND_DIRECT_REQ2, .a1 = src_dst_ids,
 	};
 
-	export_uuid((u8 *)&args.a2, uuid);
+	memcpy((void *)&args + offsetof(ffa_value_t, a2), uuid, sizeof(*uuid));
 	memcpy((void *)&args + offsetof(ffa_value_t, a4), data, sizeof(*data));
 
 	invoke_ffa_fn(args, &ret);
@@ -496,7 +496,7 @@ static int ffa_msg_send_direct_req2(u16 src_id, u16 dst_id, const uuid_t *uuid,
 		return ffa_to_linux_errno((int)ret.a2);
 
 	if (ret.a0 == FFA_MSG_SEND_DIRECT_RESP2) {
-		memcpy(data, &ret.a4, sizeof(*data));
+		memcpy(data, (void *)&ret + offsetof(ffa_value_t, a4), sizeof(*data));
 		return 0;
 	}
 
-- 
2.45.2