Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 22 Jun 2022 17:00:16 +0100
From:   Sudip Mukherjee <sudipm.mukherjee@gmail.com>
To:     Linus Torvalds <torvalds@linux-foundation.org>
Cc:     Nathan Chancellor <nathan@kernel.org>,
        Kees Cook <keescook@chromium.org>,
        Nick Desaulniers <ndesaulniers@google.com>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Netdev <netdev@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Subject: Re: mainline build failure due to 281d0c962752 ("fortify: Add Clang
 support")
Message-ID: <YrM8kC5zXzZgL/ca@debian>
References: <YrLtpixBqWDmZT/V@debian>
 <CAHk-=wiN1ujyVTgyt1GuZiyWAPfpLwwg-FY1V-J56saMyiA1Lg@mail.gmail.com>
 <YrMwXAs9apFRdkVo@debian>
 <CAHk-=wjmREcirYi4k_CBT+2U8X5VOAjQn0tVD28OdcKJKpA0zg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAHk-=wjmREcirYi4k_CBT+2U8X5VOAjQn0tVD28OdcKJKpA0zg@mail.gmail.com>
Precedence: bulk

On Wed, Jun 22, 2022 at 10:19:31AM -0500, Linus Torvalds wrote:
> On Wed, Jun 22, 2022 at 10:08 AM Sudip Mukherjee
> <sudipm.mukherjee@gmail.com> wrote:
> >
> > Yeah, true. I had to check to find out its from the memcpy() in check_image_valid().
> 
> Funky but true - I can reproduce it, and just commenting out that
> memcpy fixes the warning.
> 
> And I see nothing wrong with that code - it's copying a 'struct
> fw_section_info_st' between two other structs that seem to have arrays
> that are appropriately sized.

imho, there is no check for 'i' and it can become more than MAX_FW_TYPE_NUM and
in that case it will overwrite.

This fixes the error for me and I think will also address the concern that
clang is raising.

diff --git a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c
index 60ae8bfc5f69..bc4b3ec15925 100644
--- a/drivers/net/ethernet/huawei/hinic/hinic_devlink.c
+++ b/drivers/net/ethernet/huawei/hinic/hinic_devlink.c
@@ -41,7 +41,7 @@ static bool check_image_valid(struct hinic_devlink_priv *priv, const u8 *buf,
                return false;
        }

-       for (i = 0; i < fw_image->fw_info.fw_section_cnt; i++) {
+       for (i = 0; i < fw_image->fw_info.fw_section_cnt && i < MAX_FW_TYPE_NUM; i++) {
                len += fw_image->fw_section_info[i].fw_section_len;
                memcpy(&host_image->image_section_info[i],
                       &fw_image->fw_section_info[i],


--
Regards
Sudip