From patchwork Mon Jan 20 07:43:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Daniel Axtens X-Patchwork-Id: 11341187 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2542114B7 for ; Mon, 20 Jan 2020 07:43:56 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id DA14F2073D for ; Mon, 20 Jan 2020 07:43:55 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=axtens.net header.i=@axtens.net header.b="QrJVXlru" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DA14F2073D Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=axtens.net Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 224DC6B05BC; Mon, 20 Jan 2020 02:43:55 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 186B76B05BD; Mon, 20 Jan 2020 02:43:55 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0750A6B05BE; Mon, 20 Jan 2020 02:43:55 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0023.hostedemail.com [216.40.44.23]) by kanga.kvack.org (Postfix) with ESMTP id DFC1E6B05BC for ; Mon, 20 Jan 2020 02:43:54 -0500 (EST) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with SMTP id 9CE692C1E for ; Mon, 20 Jan 2020 07:43:54 +0000 (UTC) X-FDA: 76397223588.17.table00_22131e61dc109 X-Spam-Summary: 2,0,0,6e032832debafaeb,d41d8cd98f00b204,dja@axtens.net,:kernel-hardening@lists.openwall.com::keescook@chromium.org:linux-kernel@vger.kernel.org:akpm@linux-foundation.org:dja@axtens.net:liplianin@netup.ru,RULES_HIT:41:152:355:379:541:800:960:973:988:989:1260:1277:1311:1313:1314:1345:1359:1437:1515:1516:1518:1535:1543:1593:1594:1711:1730:1747:1777:1792:1801:2393:2559:2562:3138:3139:3140:3141:3142:3354:3865:3866:3867:3868:3870:3871:3874:4117:4250:4321:4605:5007:6119:6261:6653:7903:8603:8660:9207:10004:10400:11026:11658:11914:12043:12296:12297:12517:12519:12555:12895:12986:13148:13161:13229:13230:13894:14181:14394:14659:14721:21080:21444:21451:21627:21990:30012:30046:30054:30079,0,RBL:209.85.216.66:@axtens.net:.lbl8.mailshell.net-62.2.0.100 66.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:26,LUA_SUMMARY:none X-HE-Tag: table00_22131e61dc109 X-Filterd-Recvd-Size: 6005 Received: from mail-pj1-f66.google.com (mail-pj1-f66.google.com [209.85.216.66]) by imf46.hostedemail.com (Postfix) with ESMTP for ; Mon, 20 Jan 2020 07:43:54 +0000 (UTC) Received: by mail-pj1-f66.google.com with SMTP id m13so6770579pjb.2 for ; Sun, 19 Jan 2020 23:43:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=axtens.net; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=vGzxV+LL88B+fATt6abbCjZqtOsySmjlch7DJWcKIik=; b=QrJVXlruig0d5ecXvvbWcbKMcaX9f7bSq3DARYQAlfFXIYLoHZhe0LbKsZiw+/Pkhb Kqwn/mlr4ATbaCYDIVX2mYktnHVp6zNt5h0WTR1eNoomrO8vtOC5bN9V61quVFzBdmns X1eaQxmScrIri3kpRg8MH1wtaFeo3eYnH+fA0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=vGzxV+LL88B+fATt6abbCjZqtOsySmjlch7DJWcKIik=; b=kWG/SC6wRO6cGBf6asebX4PjbWKKa9zt3xDp9rYZde1Lm35aQG7hS42jZpgFKYrr4O USEiFJ+EhKFAeAH7uHwwLuf3PWwICS7pzVaR98c9Uv1p3YA+2myQrcAYuTvD/XYTzp0Z AIxUKNn6Tg8a1EWj7FvJ7txwxFjq+gGlEit0rAeBkjK+ESC8hF4cQU/yiBOgmv/9gNCH njwbHql2wbSuZJc75nZdph0FTSbQXpj93PvS/0oAGWABEKoFt0jAWtiCnzXE1kIoy02A EmtDRxOvgebjauN+FjkHGpF+Rw4z+tlQm3nkO27gqHam6XFiGRhxftX0E5yJHBj25S1N OWcg== X-Gm-Message-State: APjAAAVz/FANkuDrkiRG7HnPxb0NTcpo9gmJbxXXENBMHs/fYK0JCsIM N7R8jXPU5oKJ0bGrGyYjbANJYw== X-Google-Smtp-Source: APXvYqxRl1/EQDPVjdeMlWwspz86l1VCWkYGZLCYqdRqVMW2QddfAJWpVwh0yCdA65+wQtpZK0Lc5g== X-Received: by 2002:a17:90a:c385:: with SMTP id h5mr21966359pjt.122.1579506233119; Sun, 19 Jan 2020 23:43:53 -0800 (PST) Received: from localhost (2001-44b8-1113-6700-4064-d910-a710-f29a.static.ipv6.internode.on.net. [2001:44b8:1113:6700:4064:d910:a710:f29a]) by smtp.gmail.com with ESMTPSA id a23sm39832941pfg.82.2020.01.19.23.43.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 19 Jan 2020 23:43:52 -0800 (PST) From: Daniel Axtens To: kernel-hardening@lists.openwall.com, linux-mm@kvack.org, keescook@chromium.org Cc: linux-kernel@vger.kernel.org, akpm@linux-foundation.org, Daniel Axtens , "Igor M. Liplianin" Subject: [PATCH 1/5] altera-stapl: altera_get_note: prevent write beyond end of 'key' Date: Mon, 20 Jan 2020 18:43:40 +1100 Message-Id: <20200120074344.504-2-dja@axtens.net> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200120074344.504-1-dja@axtens.net> References: <20200120074344.504-1-dja@axtens.net> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: altera_get_note is called from altera_init, where key is kzalloc(33). When the allocation functions are annotated to allow the compiler to see the sizes of objects, and with FORTIFY_SOURCE, we see: In file included from drivers/misc/altera-stapl/altera.c:14:0: In function ‘strlcpy’, inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5: include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter __write_overflow(); ^~~~~~~~~~~~~~~~~~ That refers to this code in altera_get_note: if (key != NULL) strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], length); The error triggers because the length of 'key' is 33, but the copy uses length supplied as the 'length' parameter, which is always 256. Split the size parameter into key_len and val_len, and use the appropriate length depending on what is being copied. Detected by compiler error, only compile-tested. Cc: "Igor M. Liplianin" Signed-off-by: Daniel Axtens --- drivers/misc/altera-stapl/altera.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c index 25e5f24b3fec..5bdf57472314 100644 --- a/drivers/misc/altera-stapl/altera.c +++ b/drivers/misc/altera-stapl/altera.c @@ -2112,8 +2112,8 @@ static int altera_execute(struct altera_state *astate, return status; } -static int altera_get_note(u8 *p, s32 program_size, - s32 *offset, char *key, char *value, int length) +static int altera_get_note(u8 *p, s32 program_size, s32 *offset, + char *key, char *value, int keylen, int vallen) /* * Gets key and value of NOTE fields in the JBC file. * Can be called in two modes: if offset pointer is NULL, @@ -2170,7 +2170,7 @@ static int altera_get_note(u8 *p, s32 program_size, &p[note_table + (8 * i) + 4])]; if (value != NULL) - strlcpy(value, value_ptr, length); + strlcpy(value, value_ptr, vallen); } } @@ -2189,13 +2189,13 @@ static int altera_get_note(u8 *p, s32 program_size, strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], - length); + keylen); if (value != NULL) strlcpy(value, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i) + 4])], - length); + vallen); *offset = i + 1; } @@ -2449,7 +2449,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) __func__, (format_version == 2) ? "Jam STAPL" : "pre-standardized Jam 1.1"); while (altera_get_note((u8 *)fw->data, fw->size, - &offset, key, value, 256) == 0) + &offset, key, value, 32, 256) == 0) printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n", __func__, key, value); }