lkml.org 
[lkml]   [2022]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 021/114] net: chelsio: cxgb4: Avoid potential negative array offset
    Date
    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit 1c7ab9cd98b78bef1657a5db7204d8d437e24c94 ]

    Using min_t(int, ...) as a potential array index implies to the compiler
    that negative offsets should be allowed. This is not the case, though.
    Replace "int" with "unsigned int". Fixes the following warning exposed
    under future CONFIG_FORTIFY_SOURCE improvements:

    In file included from include/linux/string.h:253,
    from include/linux/bitmap.h:11,
    from include/linux/cpumask.h:12,
    from include/linux/smp.h:13,
    from include/linux/lockdep.h:14,
    from include/linux/rcupdate.h:29,
    from include/linux/rculist.h:11,
    from include/linux/pid.h:5,
    from include/linux/sched.h:14,
    from include/linux/delay.h:23,
    from drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:35:
    drivers/net/ethernet/chelsio/cxgb4/t4_hw.c: In function 't4_get_raw_vpd_params':
    include/linux/fortify-string.h:46:33: warning: '__builtin_memcpy' pointer overflow between offset 29 and size [2147483648, 4294967295] [-Warray-bounds]
    46 | #define __underlying_memcpy __builtin_memcpy
    | ^
    include/linux/fortify-string.h:388:9: note: in expansion of macro '__underlying_memcpy'
    388 | __underlying_##op(p, q, __fortify_size); \
    | ^~~~~~~~~~~~~
    include/linux/fortify-string.h:433:26: note: in expansion of macro '__fortify_memcpy_chk'
    433 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
    | ^~~~~~~~~~~~~~~~~~~~
    drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2796:9: note: in expansion of macro 'memcpy'
    2796 | memcpy(p->id, vpd + id, min_t(int, id_len, ID_LEN));
    | ^~~~~~
    include/linux/fortify-string.h:46:33: warning: '__builtin_memcpy' pointer overflow between offset 0 and size [2147483648, 4294967295] [-Warray-bounds]
    46 | #define __underlying_memcpy __builtin_memcpy
    | ^
    include/linux/fortify-string.h:388:9: note: in expansion of macro '__underlying_memcpy'
    388 | __underlying_##op(p, q, __fortify_size); \
    | ^~~~~~~~~~~~~
    include/linux/fortify-string.h:433:26: note: in expansion of macro '__fortify_memcpy_chk'
    433 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
    | ^~~~~~~~~~~~~~~~~~~~
    drivers/net/ethernet/chelsio/cxgb4/t4_hw.c:2798:9: note: in expansion of macro 'memcpy'
    2798 | memcpy(p->sn, vpd + sn, min_t(int, sn_len, SERNUM_LEN));
    | ^~~~~~

    Additionally remove needless cast from u8[] to char * in last strim()
    call.

    Reported-by: kernel test robot <lkp@intel.com>
    Link: https://lore.kernel.org/lkml/202205031926.FVP7epJM-lkp@intel.com
    Fixes: fc9279298e3a ("cxgb4: Search VPD with pci_vpd_find_ro_info_keyword()")
    Fixes: 24c521f81c30 ("cxgb4: Use pci_vpd_find_id_string() to find VPD ID string")
    Cc: Raju Rangoju <rajur@chelsio.com>
    Cc: Eric Dumazet <edumazet@google.com>
    Cc: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20220505233101.1224230-1-keescook@chromium.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 10 +++++-----
    1 file changed, 5 insertions(+), 5 deletions(-)

    diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
    index e7b4e3ed056c..8d719f82854a 100644
    --- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
    +++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
    @@ -2793,14 +2793,14 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p)
    goto out;
    na = ret;

    - memcpy(p->id, vpd + id, min_t(int, id_len, ID_LEN));
    + memcpy(p->id, vpd + id, min_t(unsigned int, id_len, ID_LEN));
    strim(p->id);
    - memcpy(p->sn, vpd + sn, min_t(int, sn_len, SERNUM_LEN));
    + memcpy(p->sn, vpd + sn, min_t(unsigned int, sn_len, SERNUM_LEN));
    strim(p->sn);
    - memcpy(p->pn, vpd + pn, min_t(int, pn_len, PN_LEN));
    + memcpy(p->pn, vpd + pn, min_t(unsigned int, pn_len, PN_LEN));
    strim(p->pn);
    - memcpy(p->na, vpd + na, min_t(int, na_len, MACADDR_LEN));
    - strim((char *)p->na);
    + memcpy(p->na, vpd + na, min_t(unsigned int, na_len, MACADDR_LEN));
    + strim(p->na);

    out:
    vfree(vpd);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-05-16 22:28    [W:4.298 / U:0.448 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site