mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
![]() The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
alauda.c | ||
cypress_atacb.c | ||
datafab.c | ||
debug.c | ||
debug.h | ||
ene_ub6250.c | ||
freecom.c | ||
initializers.c | ||
initializers.h | ||
isd200.c | ||
jumpshot.c | ||
karma.c | ||
Kconfig | ||
Makefile | ||
onetouch.c | ||
option_ms.c | ||
option_ms.h | ||
protocol.c | ||
protocol.h | ||
realtek_cr.c | ||
scsiglue.c | ||
scsiglue.h | ||
sddr09.c | ||
sddr55.c | ||
shuttle_usbat.c | ||
sierra_ms.c | ||
sierra_ms.h | ||
transport.c | ||
transport.h | ||
uas-detect.h | ||
uas.c | ||
unusual_alauda.h | ||
unusual_cypress.h | ||
unusual_datafab.h | ||
unusual_devs.h | ||
unusual_ene_ub6250.h | ||
unusual_freecom.h | ||
unusual_isd200.h | ||
unusual_jumpshot.h | ||
unusual_karma.h | ||
unusual_onetouch.h | ||
unusual_realtek.h | ||
unusual_sddr09.h | ||
unusual_sddr55.h | ||
unusual_uas.h | ||
unusual_usbat.h | ||
usb.c | ||
usb.h | ||
usual-tables.c |