KSPP / linux

Linux kernel source tree (Kernel Self Protection Project)
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Other
82 stars 5 forks source link

Fix -Warray-bounds bug in drivers/gpu/drm/nouveau/nvif/outp.c #275

Closed GustavoARSilva closed 1 year ago

GustavoARSilva commented 1 year ago
drivers/gpu/drm/nouveau/nvif/outp.c: In function ‘nvif_outp_acquire_dp’:
./include/linux/fortify-string.h:57:33: warning: array subscript ‘unsigned char[16][0]’ is partly outside array bounds of ‘u8[15]’ {aka ‘unsigned char[15]’} [-Warray-bounds=]
   57 | #define __underlying_memcpy     __builtin_memcpy
      |                                 ^
./include/linux/fortify-string.h:585:9: note: in expansion of macro ‘__underlying_memcpy’
  585 |         __underlying_##op(p, q, __fortify_size);                        \
      |         ^~~~~~~~~~~~~
./include/linux/fortify-string.h:630:26: note: in expansion of macro ‘__fortify_memcpy_chk’
  630 | #define memcpy(p, q, s)  __fortify_memcpy_chk(p, q, s,                  \
      |                          ^~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/nouveau/nvif/outp.c:140:9: note: in expansion of macro ‘memcpy’
  140 |         memcpy(args.dp.dpcd, dpcd, sizeof(args.dp.dpcd));
      |         ^~~~~~
drivers/gpu/drm/nouveau/nvif/outp.c:130:49: note: object ‘dpcd’ of size [0, 15]
  130 | nvif_outp_acquire_dp(struct nvif_outp *outp, u8 dpcd[DP_RECEIVER_CAP_SIZE],
      |                                              ~~~^~~~~~~~~~~~~~~~~~~~~~~~~~

This issue was uncovered by commit https://git.kernel.org/linus/4076ea2419cf

kees commented 1 year ago

I think this is addressed by: https://lore.kernel.org/lkml/20230204184307.never.825-kees@kernel.org/

GustavoARSilva commented 1 year ago

Fixed by this: https://lore.kernel.org/linux-hardening/20230204184307.never.825-kees@kernel.org/

GustavoARSilva commented 1 year ago

It seems the patch for this hasn't been taken yet.

kees commented 1 year ago

Now applied. commit 25feda6fbd0cfefcb69308fb20d4d4815a107c5e