mirror of
https://github.com/torvalds/linux.git
synced 2024-12-11 13:41:55 +00:00
3745488e9d
altera_get_note is called from altera_init, where key is kzalloc(33). When the allocation functions are annotated to allow the compiler to see the sizes of objects, and with FORTIFY_SOURCE, we see: In file included from drivers/misc/altera-stapl/altera.c:14:0: In function ‘strlcpy’, inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5: include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter __write_overflow(); ^~~~~~~~~~~~~~~~~~ That refers to this code in altera_get_note: if (key != NULL) strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], length); The error triggers because the length of 'key' is 33, but the copy uses length supplied as the 'length' parameter, which is always 256. Split the size parameter into key_len and val_len, and use the appropriate length depending on what is being copied. Detected by compiler error, only compile-tested. Cc: "Igor M. Liplianin" <liplianin@netup.ru> Signed-off-by: Daniel Axtens <dja@axtens.net> Link: https://lore.kernel.org/r/20200120074344.504-2-dja@axtens.net Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/202002251042.D898E67AC@keescook Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
altera-stapl | ||
c2port | ||
cardreader | ||
cb710 | ||
cxl | ||
echo | ||
eeprom | ||
genwqe | ||
habanalabs | ||
ibmasm | ||
lis3lv02d | ||
lkdtm | ||
mei | ||
mic | ||
ocxl | ||
sgi-gru | ||
sgi-xp | ||
ti-st | ||
vmw_vmci | ||
ad525x_dpot-i2c.c | ||
ad525x_dpot-spi.c | ||
ad525x_dpot.c | ||
ad525x_dpot.h | ||
apds990x.c | ||
apds9802als.c | ||
atmel_tclib.c | ||
atmel-ssc.c | ||
bh1770glc.c | ||
cs5535-mfgpt.c | ||
ds1682.c | ||
dummy-irq.c | ||
enclosure.c | ||
fastrpc.c | ||
hmc6352.c | ||
hpilo.c | ||
hpilo.h | ||
ibmvmc.c | ||
ibmvmc.h | ||
ics932s401.c | ||
isl29003.c | ||
isl29020.c | ||
Kconfig | ||
kgdbts.c | ||
lattice-ecp3-config.c | ||
Makefile | ||
pch_phub.c | ||
pci_endpoint_test.c | ||
phantom.c | ||
pti.c | ||
pvpanic.c | ||
qcom-coincell.c | ||
sram-exec.c | ||
sram.c | ||
sram.h | ||
tifm_7xx1.c | ||
tifm_core.c | ||
tsl2550.c | ||
vexpress-syscfg.c | ||
vmw_balloon.c | ||
xilinx_sdfec.c |