2018-05-17 04:21:55

by Frank Rowand

Subject: [PATCH] of: overlay: validate offset from property fixups

From: Frank Rowand <[email protected]>

The smatch static checker marks the data in offset as untrusted,
leading it to warn:

drivers/of/resolver.c:125 update_usages_of_a_phandle_reference()
error: buffer underflow 'prop->value' 's32min-s32max'

Add check to verify that offset is within the property data.

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Frank Rowand <[email protected]>
---
drivers/of/resolver.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c
index 65d0b7adfcd4..7edfac6f1914 100644
--- a/drivers/of/resolver.c
+++ b/drivers/of/resolver.c
@@ -122,6 +122,11 @@ static int update_usages_of_a_phandle_reference(struct device_node *overlay,
goto err_fail;
}

+ if (offset < 0 || offset + sizeof(__be32) > prop->length) {
+ err = -EINVAL;
+ goto err_fail;
+ }
+
*(__be32 *)(prop->value + offset) = cpu_to_be32(phandle);
}

--
Frank Rowand <[email protected]>

2018-05-17 16:57:52

by Frank Rowand

Subject: Re: [PATCH] of: overlay: validate offset from property fixups

Hi Rob,

On 05/16/18 21:19, [email protected] wrote:
> From: Frank Rowand <[email protected]>
>
> The smatch static checker marks the data in offset as untrusted,
> leading it to warn:
>
> drivers/of/resolver.c:125 update_usages_of_a_phandle_reference()
> error: buffer underflow 'prop->value' 's32min-s32max'
>
> Add check to verify that offset is within the property data.
>
> Reported-by: Dan Carpenter <[email protected]>
> Signed-off-by: Frank Rowand <[email protected]>
> ---
> drivers/of/resolver.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c
> index 65d0b7adfcd4..7edfac6f1914 100644
> --- a/drivers/of/resolver.c
> +++ b/drivers/of/resolver.c
> @@ -122,6 +122,11 @@ static int update_usages_of_a_phandle_reference(struct device_node *overlay,
> goto err_fail;
> }
>
> + if (offset < 0 || offset + sizeof(__be32) > prop->length) {
> + err = -EINVAL;
> + goto err_fail;
> + }
> +
> *(__be32 *)(prop->value + offset) = cpu_to_be32(phandle);
> }
>
>

I should have mentioned that this results in a new compile warning
for W=2 and W=3. The new if statement results in:

drivers/of/resolver.c:125:45: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]

There are other pre-existing warnings in the same file for comparing
an integer to prop->length. The correct solution is probably to
change the type of the length field in struct property to be
unsigned. I have added that task to my todo list.

-Frank

2018-05-17 16:59:09

by Frank Rowand

Subject: Re: [PATCH] of: overlay: validate offset from property fixups

On 05/17/18 09:56, Frank Rowand wrote:
> Hi Rob,
>
> On 05/16/18 21:19, [email protected] wrote:
>> From: Frank Rowand <[email protected]>
>>
>> The smatch static checker marks the data in offset as untrusted,
>> leading it to warn:
>>
>> drivers/of/resolver.c:125 update_usages_of_a_phandle_reference()
>> error: buffer underflow 'prop->value' 's32min-s32max'
>>
>> Add check to verify that offset is within the property data.
>>
>> Reported-by: Dan Carpenter <[email protected]>
>> Signed-off-by: Frank Rowand <[email protected]>
>> ---
>> drivers/of/resolver.c | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c
>> index 65d0b7adfcd4..7edfac6f1914 100644
>> --- a/drivers/of/resolver.c
>> +++ b/drivers/of/resolver.c
>> @@ -122,6 +122,11 @@ static int update_usages_of_a_phandle_reference(struct device_node *overlay,
>> goto err_fail;
>> }
>>
>> + if (offset < 0 || offset + sizeof(__be32) > prop->length) {
>> + err = -EINVAL;
>> + goto err_fail;
>> + }
>> +
>> *(__be32 *)(prop->value + offset) = cpu_to_be32(phandle);
>> }
>>
>>
>
> I should have mentioned that this results in a new compile warning
> for W=2 and W=3. The new if statement results in:
>

W=2 warning is:

> drivers/of/resolver.c:125:45: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]

W=3 warning is:

drivers/of/resolver.c:125:3: warning: conversion to 'unsigned int' from 'int' may change the sign of the result [-Wsign-conversion]

>
> There are other pre-existing warnings in the same file for comparing
> an integer to prop->length. The correct solution is probably to
> change the type of the length field in struct property to be
> unsigned. I have added that task to my todo list.
>
> -Frank
>

2018-05-23 16:45:06

by Rob Herring (Arm)

Subject: Re: [PATCH] of: overlay: validate offset from property fixups

On Wed, May 16, 2018 at 09:19:51PM -0700, [email protected] wrote:
> From: Frank Rowand <[email protected]>
>
> The smatch static checker marks the data in offset as untrusted,
> leading it to warn:
>
> drivers/of/resolver.c:125 update_usages_of_a_phandle_reference()
> error: buffer underflow 'prop->value' 's32min-s32max'
>
> Add check to verify that offset is within the property data.
>
> Reported-by: Dan Carpenter <[email protected]>
> Signed-off-by: Frank Rowand <[email protected]>
> ---
> drivers/of/resolver.c | 5 +++++
> 1 file changed, 5 insertions(+)

Applied, thanks.

Rob