This small series aims to fix an undefined behavior bug in
`struct visconti_pll_provider` and add bounds-checking
coverage at run-time for flexible-array member `hws`
in `struct clk_hw_onecell_data` when accessed throught
`struct visconti_pll_provider`.
Gustavo A. R. Silva (2):
clk: visconti: Fix undefined behavior bug in struct
visconti_pll_provider
clk: visconti: Add bounds-checking coverage for struct
visconti_pll_provider
drivers/clk/visconti/pll.c | 6 +++---
drivers/clk/visconti/pll.h | 4 +++-
2 files changed, 6 insertions(+), 4 deletions(-)
--
2.34.1
`struct clk_hw_onecell_data` is a flexible structure, which means that
it contains flexible-array member at the bottom, in this case array
`hws`:
include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };
This could potentially lead to an overwrite of the objects following
`clk_data` in `struct visconti_pll_provider`, in this case
`struct device_node *node;`, at run-time:
drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {
17 void __iomem *reg_base;
18 struct clk_hw_onecell_data clk_data;
19 struct device_node *node;
20 };
Notice that a total of 56 bytes are allocated for flexible-array `hws`
at line 328. See below:
include/dt-bindings/clock/toshiba,tmpv770x.h:
14 #define TMPV770X_NR_PLL 7
drivers/clk/visconti/pll-tmpv770x.c:
69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);
drivers/clk/visconti/pll.c:
321 struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
322 void __iomem *base,
323 unsigned long nr_plls)
324 {
325 struct visconti_pll_provider *ctx;
...
328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls), GFP_KERNEL);
`struct_size(ctx, clk_data.hws, nr_plls)` above translates to
sizeof(struct visconti_pll_provider) + sizeof(struct clk_hw *) * 7 ==
24 + 8 * 7 == 24 + 56
^^^^
|
allocated bytes for flex array `hws`
$ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o
struct visconti_pll_provider {
void * reg_base; /* 0 8 */
struct clk_hw_onecell_data clk_data; /* 8 8 */
struct device_node * node; /* 16 8 */
/* size: 24, cachelines: 1, members: 3 */
/* last cacheline: 24 bytes */
};
And then, after the allocation, some data is written into all members
of `struct visconti_pll_provider`:
332 for (i = 0; i < nr_plls; ++i)
333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
334
335 ctx->node = np;
336 ctx->reg_base = base;
337 ctx->clk_data.num = nr_plls;
Fix all these by placing the declaration of object `clk_data` at the
end of `struct visconti_pll_provider`. Also, add a comment to make it
clear that this object must always be last in the structure, and
prevent this bug from being introduced again in the future.
Fixes: b4cbe606dc36 ("clk: visconti: Add support common clock driver and reset driver")
Cc: [email protected]
Signed-off-by: Gustavo A. R. Silva <[email protected]>
---
drivers/clk/visconti/pll.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/visconti/pll.h b/drivers/clk/visconti/pll.h
index 01d07f1bf01b..c4bd40676da4 100644
--- a/drivers/clk/visconti/pll.h
+++ b/drivers/clk/visconti/pll.h
@@ -15,8 +15,10 @@
struct visconti_pll_provider {
void __iomem *reg_base;
- struct clk_hw_onecell_data clk_data;
struct device_node *node;
+
+ /* Must be last */
+ struct clk_hw_onecell_data clk_data;
};
#define VISCONTI_PLL_RATE(_rate, _dacen, _dsmen, \
--
2.34.1
In order to gain the bounds-checking coverage that __counted_by provides
to flexible-array members at run-time via CONFIG_UBSAN_BOUNDS (for array
indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions),
we must make sure that the counter member, in this particular case `num`,
is updated before the first access to the flex-array member, in this
particular case array `hws`. See below:
commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
__counted_by") introduced `__counted_by` for `struct clk_hw_onecell_data`
together with changes to relocate some of assignments of counter `num`
before `hws` is accessed:
include/linux/clk-provider.h:
1380 struct clk_hw_onecell_data {
1381 unsigned int num;
1382 struct clk_hw *hws[] __counted_by(num);
1383 };
However, this structure is used as a member in other structs, in this
case in `struct visconti_pll_provider`:
drivers/clk/visconti/pll.h:
16 struct visconti_pll_provider {
17 void __iomem *reg_base;
18 struct device_node *node;
19
20 /* Must be last */
21 struct clk_hw_onecell_data clk_data;
22 };
Hence, we need to move the assignments to `ctx->clk_data.num` after
allocation for `struct visconti_pll_provider` and before accessing the
flexible array `ctx->clk_data.hws`. And, as assignments for all members
in `struct visconti_pll_provider` are originally adjacent to each other,
relocate all assignments together, so we don't split up
`ctx->clk_data.hws = nr_plls` from the rest. :)
Signed-off-by: Gustavo A. R. Silva <[email protected]>
---
drivers/clk/visconti/pll.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/clk/visconti/pll.c b/drivers/clk/visconti/pll.c
index 1f3234f22667..e9cd80e085dc 100644
--- a/drivers/clk/visconti/pll.c
+++ b/drivers/clk/visconti/pll.c
@@ -329,12 +329,12 @@ struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
if (!ctx)
return ERR_PTR(-ENOMEM);
- for (i = 0; i < nr_plls; ++i)
- ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
-
ctx->node = np;
ctx->reg_base = base;
ctx->clk_data.num = nr_plls;
+ for (i = 0; i < nr_plls; ++i)
+ ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
+
return ctx;
}
--
2.34.1
On Wed, Oct 11, 2023 at 08:17:36PM -0600, Gustavo A. R. Silva wrote:
> `struct clk_hw_onecell_data` is a flexible structure, which means that
> it contains flexible-array member at the bottom, in this case array
> `hws`:
>
> include/linux/clk-provider.h:
> 1380 struct clk_hw_onecell_data {
> 1381 unsigned int num;
> 1382 struct clk_hw *hws[] __counted_by(num);
> 1383 };
>
> This could potentially lead to an overwrite of the objects following
> `clk_data` in `struct visconti_pll_provider`, in this case
> `struct device_node *node;`, at run-time:
>
> drivers/clk/visconti/pll.h:
> 16 struct visconti_pll_provider {
> 17 void __iomem *reg_base;
> 18 struct clk_hw_onecell_data clk_data;
> 19 struct device_node *node;
> 20 };
>
> Notice that a total of 56 bytes are allocated for flexible-array `hws`
> at line 328. See below:
>
> include/dt-bindings/clock/toshiba,tmpv770x.h:
> 14 #define TMPV770X_NR_PLL 7
>
> drivers/clk/visconti/pll-tmpv770x.c:
> 69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);
>
> drivers/clk/visconti/pll.c:
> 321 struct visconti_pll_provider * __init visconti_init_pll(struct device_node *np,
> 322 void __iomem *base,
> 323 unsigned long nr_plls)
> 324 {
> 325 struct visconti_pll_provider *ctx;
> ...
> 328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls), GFP_KERNEL);
>
> `struct_size(ctx, clk_data.hws, nr_plls)` above translates to
> sizeof(struct visconti_pll_provider) + sizeof(struct clk_hw *) * 7 ==
> 24 + 8 * 7 == 24 + 56
> ^^^^
> |
> allocated bytes for flex array `hws`
>
> $ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o
> struct visconti_pll_provider {
> void * reg_base; /* 0 8 */
> struct clk_hw_onecell_data clk_data; /* 8 8 */
> struct device_node * node; /* 16 8 */
>
> /* size: 24, cachelines: 1, members: 3 */
> /* last cacheline: 24 bytes */
> };
>
> And then, after the allocation, some data is written into all members
> of `struct visconti_pll_provider`:
>
> 332 for (i = 0; i < nr_plls; ++i)
> 333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
> 334
> 335 ctx->node = np;
> 336 ctx->reg_base = base;
> 337 ctx->clk_data.num = nr_plls;
>
> Fix all these by placing the declaration of object `clk_data` at the
> end of `struct visconti_pll_provider`. Also, add a comment to make it
> clear that this object must always be last in the structure, and
> prevent this bug from being introduced again in the future.
>
> Fixes: b4cbe606dc36 ("clk: visconti: Add support common clock driver and reset driver")
> Cc: [email protected]
> Signed-off-by: Gustavo A. R. Silva <[email protected]>
Another good catch. :)
Reviewed-by: Kees Cook <[email protected]>
--
Kees Cook
On Wed, Oct 11, 2023 at 08:18:45PM -0600, Gustavo A. R. Silva wrote:
> In order to gain the bounds-checking coverage that __counted_by provides
> to flexible-array members at run-time via CONFIG_UBSAN_BOUNDS (for array
> indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions),
> we must make sure that the counter member, in this particular case `num`,
> is updated before the first access to the flex-array member, in this
> particular case array `hws`. See below:
>
> commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
> __counted_by") introduced `__counted_by` for `struct clk_hw_onecell_data`
> together with changes to relocate some of assignments of counter `num`
> before `hws` is accessed:
>
> include/linux/clk-provider.h:
> 1380 struct clk_hw_onecell_data {
> 1381 unsigned int num;
> 1382 struct clk_hw *hws[] __counted_by(num);
> 1383 };
>
> However, this structure is used as a member in other structs, in this
> case in `struct visconti_pll_provider`:
>
> drivers/clk/visconti/pll.h:
> 16 struct visconti_pll_provider {
> 17 void __iomem *reg_base;
> 18 struct device_node *node;
> 19
> 20 /* Must be last */
> 21 struct clk_hw_onecell_data clk_data;
> 22 };
>
> Hence, we need to move the assignments to `ctx->clk_data.num` after
> allocation for `struct visconti_pll_provider` and before accessing the
> flexible array `ctx->clk_data.hws`. And, as assignments for all members
> in `struct visconti_pll_provider` are originally adjacent to each other,
> relocate all assignments together, so we don't split up
> `ctx->clk_data.hws = nr_plls` from the rest. :)
>
> Signed-off-by: Gustavo A. R. Silva <[email protected]>
Looks good; thanks!
Reviewed-by: Kees Cook <[email protected]>
--
Kees Cook
Hi Gustavo A. R. Silva,
Thanks for your patch!
> -----Original Message-----
> From: Gustavo A. R. Silva <[email protected]>
> Sent: Thursday, October 12, 2023 11:18 AM
> To: Michael Turquette <[email protected]>; Stephen Boyd
> <[email protected]>; iwamatsu nobuhiro($B4d>>(B $B?.MN(B $B!{#D#I#T#C""#D#I#T!{#O(B
> $B#S#T(B) <[email protected]>
> Cc: Kees Cook <[email protected]>; [email protected];
> [email protected]; [email protected]; Gustavo A.
> R. Silva <[email protected]>; [email protected]
> Subject: [PATCH 1/2][next] clk: visconti: Fix undefined behavior bug in struct
> visconti_pll_provider
>
> `struct clk_hw_onecell_data` is a flexible structure, which means that it
> contains flexible-array member at the bottom, in this case array
> `hws`:
>
> include/linux/clk-provider.h:
> 1380 struct clk_hw_onecell_data {
> 1381 unsigned int num;
> 1382 struct clk_hw *hws[] __counted_by(num);
> 1383 };
>
> This could potentially lead to an overwrite of the objects following `clk_data` in
> `struct visconti_pll_provider`, in this case `struct device_node *node;`, at
> run-time:
>
> drivers/clk/visconti/pll.h:
> 16 struct visconti_pll_provider {
> 17 void __iomem *reg_base;
> 18 struct clk_hw_onecell_data clk_data;
> 19 struct device_node *node;
> 20 };
>
> Notice that a total of 56 bytes are allocated for flexible-array `hws` at line 328.
> See below:
>
> include/dt-bindings/clock/toshiba,tmpv770x.h:
> 14 #define TMPV770X_NR_PLL 7
>
> drivers/clk/visconti/pll-tmpv770x.c:
> 69 ctx = visconti_init_pll(np, reg_base, TMPV770X_NR_PLL);
>
> drivers/clk/visconti/pll.c:
> 321 struct visconti_pll_provider * __init visconti_init_pll(struct device_node
> *np,
> 322 void __iomem
> *base,
> 323 unsigned long
> nr_plls)
> 324 {
> 325 struct visconti_pll_provider *ctx;
> ...
> 328 ctx = kzalloc(struct_size(ctx, clk_data.hws, nr_plls),
> GFP_KERNEL);
>
> `struct_size(ctx, clk_data.hws, nr_plls)` above translates to sizeof(struct
> visconti_pll_provider) + sizeof(struct clk_hw *) * 7 ==
> 24 + 8 * 7 == 24 + 56
> ^^^^
> |
> allocated bytes for flex array `hws`
>
> $ pahole -C visconti_pll_provider drivers/clk/visconti/pll.o struct
> visconti_pll_provider {
> void * reg_base; /* 0 8 */
> struct clk_hw_onecell_data clk_data; /* 8 8 */
> struct device_node * node; /* 16 8 */
>
> /* size: 24, cachelines: 1, members: 3 */
> /* last cacheline: 24 bytes */
> };
>
> And then, after the allocation, some data is written into all members of `struct
> visconti_pll_provider`:
>
> 332 for (i = 0; i < nr_plls; ++i)
> 333 ctx->clk_data.hws[i] = ERR_PTR(-ENOENT);
> 334
> 335 ctx->node = np;
> 336 ctx->reg_base = base;
> 337 ctx->clk_data.num = nr_plls;
>
> Fix all these by placing the declaration of object `clk_data` at the end of `struct
> visconti_pll_provider`. Also, add a comment to make it clear that this object
> must always be last in the structure, and prevent this bug from being
> introduced again in the future.
>
> Fixes: b4cbe606dc36 ("clk: visconti: Add support common clock driver and
> reset driver")
> Cc: [email protected]
> Signed-off-by: Gustavo A. R. Silva <[email protected]>
Acked-by: Nobuhiro Iwamatsu <[email protected]>
Best regards,
Nobuhiro
Hi Gustavo A. R. Silva,
Thanks for your patch!
> -----Original Message-----
> From: Gustavo A. R. Silva <[email protected]>
> Sent: Thursday, October 12, 2023 11:19 AM
> To: Michael Turquette <[email protected]>; Stephen Boyd
> <[email protected]>; iwamatsu nobuhiro($B4d>>(B $B?.MN(B $B!{#D#I#T#C""#D#I#T!{#O(B
> $B#S#T(B) <[email protected]>
> Cc: Kees Cook <[email protected]>; [email protected];
> [email protected]; [email protected]; Gustavo A.
> R. Silva <[email protected]>; [email protected]
> Subject: [PATCH 2/2][next] clk: visconti: Add bounds-checking coverage for
> struct visconti_pll_provider
>
> In order to gain the bounds-checking coverage that __counted_by provides to
> flexible-array members at run-time via CONFIG_UBSAN_BOUNDS (for array
> indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> functions), we must make sure that the counter member, in this particular case
> `num`, is updated before the first access to the flex-array member, in this
> particular case array `hws`. See below:
>
> commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with
> __counted_by") introduced `__counted_by` for `struct clk_hw_onecell_data`
> together with changes to relocate some of assignments of counter `num`
> before `hws` is accessed:
>
> include/linux/clk-provider.h:
> 1380 struct clk_hw_onecell_data {
> 1381 unsigned int num;
> 1382 struct clk_hw *hws[] __counted_by(num);
> 1383 };
>
> However, this structure is used as a member in other structs, in this case in
> `struct visconti_pll_provider`:
>
> drivers/clk/visconti/pll.h:
> 16 struct visconti_pll_provider {
> 17 void __iomem *reg_base;
> 18 struct device_node *node;
> 19
> 20 /* Must be last */
> 21 struct clk_hw_onecell_data clk_data;
> 22 };
>
> Hence, we need to move the assignments to `ctx->clk_data.num` after
> allocation for `struct visconti_pll_provider` and before accessing the flexible
> array `ctx->clk_data.hws`. And, as assignments for all members in `struct
> visconti_pll_provider` are originally adjacent to each other, relocate all
> assignments together, so we don't split up `ctx->clk_data.hws = nr_plls` from
> the rest. :)
>
> Signed-off-by: Gustavo A. R. Silva <[email protected]>
Acked-by: Nobuhiro Iwamatsu <[email protected]>
Best regards,
Nobuhiro