lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 16 Jun 2022 10:19:28 -0700 From: Nathan Chancellor <nathan@...nel.org> To: Kees Cook <keescook@...omium.org> Cc: "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Nick Desaulniers <ndesaulniers@...gle.com>, Tom Rix <trix@...hat.com>, Leon Romanovsky <leon@...nel.org>, Jiri Pirko <jiri@...dia.com>, Vladimir Oltean <olteanv@...il.com>, Simon Horman <simon.horman@...igine.com>, netdev@...r.kernel.org, llvm@...ts.linux.dev, linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org Subject: Re: [PATCH] hinic: Replace memcpy() with direct assignment On Wed, Jun 15, 2022 at 10:23:12PM -0700, Kees Cook wrote: > Under CONFIG_FORTIFY_SOURCE=y and CONFIG_UBSAN_BOUNDS=y, Clang is bugged > here for calculating the size of the destination buffer (0x10 instead of > 0x14). This copy is a fixed size (sizeof(struct fw_section_info_st)), with > the source and dest being struct fw_section_info_st, so the memcpy should > be safe, assuming the index is within bounds, which is UBSAN_BOUNDS's > responsibility to figure out. > > Avoid the whole thing and just do a direct assignment. This results in > no change to the executable code. > > Cc: "David S. Miller" <davem@...emloft.net> > Cc: Eric Dumazet <edumazet@...gle.com> > Cc: Jakub Kicinski <kuba@...nel.org> > Cc: Paolo Abeni <pabeni@...hat.com> > Cc: Nathan Chancellor <nathan@...nel.org> > Cc: Nick Desaulniers <ndesaulniers@...gle.com> > Cc: Tom Rix <trix@...hat.com> > Cc: Leon Romanovsky <leon@...nel.org> > Cc: Jiri Pirko <jiri@...dia.com> > Cc: Vladimir Oltean <olteanv@...il.com> > Cc: Simon Horman <simon.horman@...igine.com> > Cc: netdev@...r.kernel.org > Cc: llvm@...ts.linux.dev > Link: https://github.com/ClangBuiltLinux/linux/issues/1592 > Signed-off-by: Kees Cook <keescook@...omium.org> Tested-by: Nathan Chancellor <nathan@...nel.org> # build > --- > drivers/net/ethernet/huawei/hinic/hinic_devlink.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c > index 60ae8bfc5f69..1749d26f4bef 100644 > --- a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c > +++ b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c > @@ -43,9 +43,7 @@ static bool check_image_valid(struct hinic_devlink_priv *priv, const u8 *buf, > > for (i = 0; i < fw_image->fw_info.fw_section_cnt; i++) { > len += fw_image->fw_section_info[i].fw_section_len; > - memcpy(&host_image->image_section_info[i], > - &fw_image->fw_section_info[i], > - sizeof(struct fw_section_info_st)); > + host_image->image_section_info[i] = fw_image->fw_section_info[i]; > } > > if (len != fw_image->fw_len || > -- > 2.32.0 >
Powered by blists - more mailing lists