Received: by 2002:a17:90a:1609:0:0:0:0 with SMTP id n9csp852702pja; Wed, 1 Apr 2020 09:51:55 -0700 (PDT) X-Google-Smtp-Source: ADFU+vs2Wq/rBeSR6B573Fa5TyArV2MNCWKz3Bz7+FVR2v+BpkpmVJJSp5VJy4CNwYCChuuFyckJ X-Received: by 2002:a4a:a126:: with SMTP id i38mr17860781ool.11.1585759914841; Wed, 01 Apr 2020 09:51:54 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1585759914; cv=none; d=google.com; s=arc-20160816; b=xQjYOZeMjiR453OlHtRLeREEx539pZ7YC4OSVgxU4FghJp4NMz10eZqeLIvgXeFDhd xlw8ZMt/4zkV+t4ntaNmYAanVeFGBlBo95l53mifboPDKmy/Jyj4ONk/tFbg4yF1BW+l jvMfuvPmjDKrT8sayb40nWxyx9GyWceyNwkhTzboeOnQYGBhzEWztmj/5u+rK7Tz/mEI PSkIReeJ9pDdYGuaPbmgkSGAIaPYDKWzKi5UzP608mNqsC4RQmczYPsV3eQs1f58hWFP DnrL5n4TUUPDFU7hQCf8qgwDbD3zcpNiIQ70CsH+OLpmagLP14OBnpxElTwWv3mmsnuL 4Yxg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=9qZOJNALs1zr+8DDrcRSeT5lG7yXv8GRYKs/beZ82A4=; b=rnj08MrlMrhZoATpxZsY4paewvQloBT/QZxNAYBPeCvbGTA/fk6K5ibuZ2K2LxX6Mf BaFEIqr91gAmmtPI06MzJ8I/Zcvm2N17o7csGjsNRVLn6Eqb9HeHdiUMi92akzASyAnU JNsERN2p4vXbHIRzl1dg+/gPUvutovvR6/87jI0phX0hhAgWAqKFxE5Yjxywkzyk8i3K w0g75UU7o/tB0v7q5Us4FoMQF8Hm1+EBr4u6QADyA/L0MXtME2NmSc/y4+2kyj6sj5XT vIQZTSPeALb3hKRazcbcty6/j2e5eLEI9ItthuqitZr0I4LMjmVb/nEHN9Qe1trYwO0w XgWg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=tfYHMleE; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m26si1169597otj.109.2020.04.01.09.51.41; Wed, 01 Apr 2020 09:51:54 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=tfYHMleE; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389449AbgDAQlt (ORCPT + 99 others); Wed, 1 Apr 2020 12:41:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:42146 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389438AbgDAQln (ORCPT ); Wed, 1 Apr 2020 12:41:43 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 81751206F8; Wed, 1 Apr 2020 16:41:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759303; bh=Wk5vG2jvv3zKm1H8ZHIEKdgfGVZnA91k1WpdRvzFCCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tfYHMleEFfSjTyFa0bmIeJFfl7mui7iq0Oy3a4E1iaNQ6UCdoNI7EbvZ7aN6PUDsV EeeIja8h7OYo3gAtqM2DkN6ycLIZuBwyZ5/dtXvbRj4Rhtence6NY8QCz9aD5oXcSL QZPp2ALWxDn3iiZVwOHfMb5jaQ6sttn3upwWf+so= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Igor M. Liplianin" , Daniel Axtens , Kees Cook , Sasha Levin Subject: [PATCH 4.14 009/148] altera-stapl: altera_get_note: prevent write beyond end of key Date: Wed, 1 Apr 2020 18:16:41 +0200 Message-Id: <20200401161553.112812078@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161552.245876366@linuxfoundation.org> References: <20200401161552.245876366@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Daniel Axtens [ Upstream commit 3745488e9d599916a0b40d45d3f30e3d4720288e ] altera_get_note is called from altera_init, where key is kzalloc(33). When the allocation functions are annotated to allow the compiler to see the sizes of objects, and with FORTIFY_SOURCE, we see: In file included from drivers/misc/altera-stapl/altera.c:14:0: In function ‘strlcpy’, inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5: include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter __write_overflow(); ^~~~~~~~~~~~~~~~~~ That refers to this code in altera_get_note: if (key != NULL) strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], length); The error triggers because the length of 'key' is 33, but the copy uses length supplied as the 'length' parameter, which is always 256. Split the size parameter into key_len and val_len, and use the appropriate length depending on what is being copied. Detected by compiler error, only compile-tested. Cc: "Igor M. Liplianin" Signed-off-by: Daniel Axtens Link: https://lore.kernel.org/r/20200120074344.504-2-dja@axtens.net Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/202002251042.D898E67AC@keescook Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/misc/altera-stapl/altera.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c index 494e263daa748..b7ee8043a133e 100644 --- a/drivers/misc/altera-stapl/altera.c +++ b/drivers/misc/altera-stapl/altera.c @@ -2126,8 +2126,8 @@ static int altera_execute(struct altera_state *astate, return status; } -static int altera_get_note(u8 *p, s32 program_size, - s32 *offset, char *key, char *value, int length) +static int altera_get_note(u8 *p, s32 program_size, s32 *offset, + char *key, char *value, int keylen, int vallen) /* * Gets key and value of NOTE fields in the JBC file. * Can be called in two modes: if offset pointer is NULL, @@ -2184,7 +2184,7 @@ static int altera_get_note(u8 *p, s32 program_size, &p[note_table + (8 * i) + 4])]; if (value != NULL) - strlcpy(value, value_ptr, length); + strlcpy(value, value_ptr, vallen); } } @@ -2203,13 +2203,13 @@ static int altera_get_note(u8 *p, s32 program_size, strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], - length); + keylen); if (value != NULL) strlcpy(value, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i) + 4])], - length); + vallen); *offset = i + 1; } @@ -2463,7 +2463,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) __func__, (format_version == 2) ? "Jam STAPL" : "pre-standardized Jam 1.1"); while (altera_get_note((u8 *)fw->data, fw->size, - &offset, key, value, 256) == 0) + &offset, key, value, 32, 256) == 0) printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n", __func__, key, value); } -- 2.20.1