Messages in this thread | | | Date | Tue, 25 Jan 2022 09:43:29 -0800 | From | Kees Cook <> | Subject | Re: [PATCH 5.17-rc1 v2] eeprom: at25: Restore missing allocation |
| |
On Tue, Jan 25, 2022 at 04:25:39PM +0100, Geert Uytterhoeven wrote: > On Tue, Jan 25, 2022 at 3:20 PM Geert Uytterhoeven <geert@linux-m68k.org> wrote: > > On Fri, Jan 21, 2022 at 12:33 AM Kees Cook <keescook@chromium.org> wrote: > > > The at25 driver regressed in v5.17-rc1 due to a broken conflict > > > resolution: the allocation of the object was accidentally removed. Restore > > > it. > > > > > > This was found when building under CONFIG_FORTIFY_SOURCE=y and > > > -Warray-bounds, which complained about strncpy() being used against an > > > empty object: > > > > > > In function 'strncpy', > > > inlined from 'at25_fw_to_chip.constprop' at drivers/misc/eeprom/at25.c:312:2: > > > ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds] > > > 48 | #define __underlying_strncpy __builtin_strncpy > > > | ^ > > > ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy' > > > 59 | return __underlying_strncpy(p, q, size); > > > | ^~~~~~~~~~~~~~~~~~~~ > > > In function 'strncpy', > > > inlined from 'at25_fram_to_chip' at drivers/misc/eeprom/at25.c:373:2, > > > inlined from 'at25_probe' at drivers/misc/eeprom/at25.c:453:10: > > > ./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds] > > > 48 | #define __underlying_strncpy __builtin_strncpy > > > | ^ > > > ./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy' > > > 59 | return __underlying_strncpy(p, q, size); > > > | ^~~~~~~~~~~~~~~~~~~~ > > > > On real hardware: > > > > Unable to handle kernel access to user memory outside uaccess > > routines at virtual address 0000000000000028 > > ... > > pc : __mutex_init+0x20/0x68 > > lr : at25_probe+0x8c/0x4d8 > > To avoid confusion: of course the crash happens only without Kees' > patch. I just wanted to point out what happens when you boot on > real hardware, as it might be worthwhile to add that to the commit > description.
Okay, whew. :)
-- Kees Cook
| |