Received: by 2002:a05:6a10:eb17:0:0:0:0 with SMTP id hx23csp452924pxb; Thu, 9 Sep 2021 04:57:26 -0700 (PDT) X-Google-Smtp-Source: ABdhPJx0LwXAllPyu1yb/SPl5cTNdGGJLkn8xHT0Fuh1z6xPM5/clMLwPg7g0O+T9aE4VZ1QhGvS X-Received: by 2002:a5d:8505:: with SMTP id q5mr2254146ion.53.1631188645824; Thu, 09 Sep 2021 04:57:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631188645; cv=none; d=google.com; s=arc-20160816; b=L8bspGzjPmazcreAql0K6B3jupdtOWLtSiBzEFr8B37AJeIS6NdN+QkHcY+zQ1DGwz JIummhvqY3/U1FOkZIXNCrEAQjcGNPC/08udfdRZtwWbd0ZrG/AiFye437alq9Fua88e JAUKbvDR5RO/OjK119CCd+dibBcOicBo7dhzBlI3L+2inBxaBfS6D+vRSz5Pwd5k+CKJ Hwp+smkOQokjpaNUiljwsT1Q7knQQqKTcwzm/x87pG6maN2FYlJnXlXdvQeSSwSoyZ/W GdHDZgAKFEqX0aLh8ULOjbwajJaS7LZv9x5zwK+6/C1uOPnCDkAf4TtvNbHl8p/y1JMP rAhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=fCJYJ+okAZ3cuulBPopzWbxi0M4pK6oYg50ROQoiG8A=; b=CBtdsnJHCStYE9Z0ilWUwzmddnA+XQqEpzY9pE9wLpl3xbEg2W3vgz1OLcJWytIWZe uRSrEAv0kfAvorNIs9dHmAH8r7vX/YH2BCJX8JdeoX72/zeDYaqILMlEsEvsR3Lx7CXt 7AIwEeBuf8eBz9UCRD/R08CEzKAWy/+j0hhvKz33oxSVuzxQsEp8ZSy5dMJKRHZYMDMN euk1AGR0FZNsfHPlBWygmCBqJggsiiq5fR30fni3/jecOiWuN1n9BBu2Ds/FvxwzxtqE +NyPx2VrQ17GZmV3/Qj3VwQX+0Xy/FNpcHDBeL83g8/c22AkX13HijlP6M3gThbZ/Z5x ITtQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Hc9XVy+n; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id y9si1616196ilc.12.2021.09.09.04.57.14; Thu, 09 Sep 2021 04:57:25 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Hc9XVy+n; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244190AbhIIL5m (ORCPT + 99 others); Thu, 9 Sep 2021 07:57:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:34410 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244324AbhIILyc (ORCPT ); Thu, 9 Sep 2021 07:54:32 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id C84D7611EE; Thu, 9 Sep 2021 11:44:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1631187892; bh=wT3iu+1KsIblfmC2Xxu1rpoOWJc5iroPFIXC6zv3PRM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Hc9XVy+nNePuAr9gy7gPS1yDjyvWb0LGGbKaSUT9C7KTgvCX8Xn6PZCstglMhQuNa 2JWrFuZm2LifBctYVn43sgf5PkWEZJ92TJPE8gTMxM5Y1tbb/GTYGBdf+s5z4CE8KN H73Bm1QiDGgPOORfuYkl5V8AcmYvj1wqo4pisJuFnfNBjzgMRkuWJiV5FeMVpCKDmV ffs61WOzPaGPTnnN0zYriS9Ff7fygk/oExrUfMZ+Qh4t4UhcHRj890gS3PCqM+U5/N thiWqAS5+PnYhG8/B3DbHIQsM2zUFarlrzL4wGotQ10I+18gj5TdoWXfRmL0ukHpuD nJcMvQS6pktxA== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Kees Cook , Greg Kroah-Hartman , linux-staging@lists.linux.dev, Sasha Levin Subject: [PATCH AUTOSEL 5.14 173/252] staging: rts5208: Fix get_ms_information() heap buffer size Date: Thu, 9 Sep 2021 07:39:47 -0400 Message-Id: <20210909114106.141462-173-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210909114106.141462-1-sashal@kernel.org> References: <20210909114106.141462-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Kees Cook [ Upstream commit cbe34165cc1b7d1110b268ba8b9f30843c941639 ] Fix buf allocation size (it needs to be 2 bytes larger). Found when __alloc_size() annotations were added to kmalloc() interfaces. In file included from ./include/linux/string.h:253, from ./include/linux/bitmap.h:10, from ./include/linux/cpumask.h:12, from ./arch/x86/include/asm/paravirt.h:17, from ./arch/x86/include/asm/irqflags.h:63, from ./include/linux/irqflags.h:16, from ./include/linux/rcupdate.h:26, from ./include/linux/rculist.h:11, from ./include/linux/pid.h:5, from ./include/linux/sched.h:14, from ./include/linux/blkdev.h:5, from drivers/staging/rts5208/rtsx_scsi.c:12: In function 'get_ms_information', inlined from 'ms_sp_cmnd' at drivers/staging/rts5208/rtsx_scsi.c:2877:12, inlined from 'rtsx_scsi_handler' at drivers/staging/rts5208/rtsx_scsi.c:3247:12: ./include/linux/fortify-string.h:54:29: warning: '__builtin_memcpy' forming offset [106, 107] is out of the bounds [0, 106] [-Warray-bounds] 54 | #define __underlying_memcpy __builtin_memcpy | ^ ./include/linux/fortify-string.h:417:2: note: in expansion of macro '__underlying_memcpy' 417 | __underlying_##op(p, q, __fortify_size); \ | ^~~~~~~~~~~~~ ./include/linux/fortify-string.h:463:26: note: in expansion of macro '__fortify_memcpy_chk' 463 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^~~~~~~~~~~~~~~~~~~~ drivers/staging/rts5208/rtsx_scsi.c:2851:3: note: in expansion of macro 'memcpy' 2851 | memcpy(buf + i, ms_card->raw_sys_info, 96); | ^~~~~~ Cc: Greg Kroah-Hartman Cc: linux-staging@lists.linux.dev Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20210818044252.1533634-1-keescook@chromium.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/staging/rts5208/rtsx_scsi.c | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c index 1deb74112ad4..11d9d9155eef 100644 --- a/drivers/staging/rts5208/rtsx_scsi.c +++ b/drivers/staging/rts5208/rtsx_scsi.c @@ -2802,10 +2802,10 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip) } if (dev_info_id == 0x15) { - buf_len = 0x3A; + buf_len = 0x3C; data_len = 0x3A; } else { - buf_len = 0x6A; + buf_len = 0x6C; data_len = 0x6A; } @@ -2855,11 +2855,7 @@ static int get_ms_information(struct scsi_cmnd *srb, struct rtsx_chip *chip) } rtsx_stor_set_xfer_buf(buf, buf_len, srb); - - if (dev_info_id == 0x15) - scsi_set_resid(srb, scsi_bufflen(srb) - 0x3C); - else - scsi_set_resid(srb, scsi_bufflen(srb) - 0x6C); + scsi_set_resid(srb, scsi_bufflen(srb) - buf_len); kfree(buf); return STATUS_SUCCESS; -- 2.30.2