]> git.ipfire.org Git - thirdparty/linux.git/commit
nouveau/gsp: Avoid addressing beyond end of rpc->entries
authorKees Cook <keescook@chromium.org>
Sat, 30 Mar 2024 14:12:03 +0000 (07:12 -0700)
committerDanilo Krummrich <dakr@redhat.com>
Fri, 5 Apr 2024 16:30:29 +0000 (18:30 +0200)
commit838ae9f45c4e43b4633d8b0ad1fbedff9ecf177d
tree5ddd5581122b0da8a3f793b45814e29d8a117480
parent07ed11afb68d94eadd4ffc082b97c2331307c5ea
nouveau/gsp: Avoid addressing beyond end of rpc->entries

Using the end of rpc->entries[] for addressing runs into both compile-time
and run-time detection of accessing beyond the end of the array. Use the
base pointer instead, since was allocated with the additional bytes for
storing the strings. Avoids the following warning in future GCC releases
with support for __counted_by:

In function 'fortify_memcpy_chk',
    inlined from 'r535_gsp_rpc_set_registry' at ../drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1123:3:
../include/linux/fortify-string.h:553:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
  553 |                         __write_overflow_field(p_size_field, size);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

for this code:

strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES];
...
                memcpy(strings, r535_registry_entries[i].name, name_len);

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Danilo Krummrich <dakr@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240330141159.work.063-kees@kernel.org
drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c