From: Kees Cook <keescook@chromium.org>
To: Guenter Roeck <linux@roeck-us.net>
Cc: linux-kernel@vger.kernel.org, Arnd Bergmann <arnd@arndb.de>,
Masahiro Yamada <masahiroy@kernel.org>,
linux-kbuild@vger.kernel.org,
"Gustavo A . R . Silva" <gustavoars@kernel.org>,
clang-built-linux@googlegroups.com,
linux-hardening@vger.kernel.org
Subject: Re: [PATCH 4/5] Makefile: Enable -Warray-bounds
Date: Wed, 2 Feb 2022 19:03:39 -0800 [thread overview]
Message-ID: <202202021902.97BAE673@keescook> (raw)
In-Reply-To: <cbf0cf07-2350-ed23-f6be-b2686c6a0cea@roeck-us.net>
On Wed, Feb 02, 2022 at 03:33:11PM -0800, Guenter Roeck wrote:
> On 2/2/22 12:56, Kees Cook wrote:
> > On Wed, Feb 02, 2022 at 08:09:03AM -0800, Guenter Roeck wrote:
> > > xtensa:allmodconfig:
> > > --------------
> > > Error log:
> > > In file included from include/linux/uaccess.h:11,
> > > from include/linux/sched/task.h:11,
> > > from arch/xtensa/kernel/process.c:21:
> > > arch/xtensa/kernel/process.c: In function 'copy_thread':
> > > arch/xtensa/kernel/process.c:262:52: error: array subscript 53 is above array bounds of 'long unsigned int[16]'
> >
> > I assume this is a weird cast. I will also check this one out.
> >
>
> int callinc = (regs->areg[0] >> 30) & 3;
> int caller_ars = XCHAL_NUM_AREGS - callinc * 4;
> put_user(regs->areg[caller_ars+1],
> ^^^^^^^^^^^^^^^^^^^^^^^^
> (unsigned __user*)(usp - 12));
>
> I think the problem is that XCHAL_NUM_AREGS can be up to 64,
> but the size of struct pt_regs->areg[] is fixed to 16.
Yeah, that's what I found too. The comment about pt_regs::areg seems to
hint that things treat pt_regs differently. I've asked on the xtensa list:
https://lore.kernel.org/linux-hardening/202202021501.DA6594BFC@keescook/
--
Kees Cook
next prev parent reply other threads:[~2022-02-03 3:03 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-18 8:11 [PATCH 0/5] Enable -Warray-bounds and -Wzero-length-bounds Kees Cook
2021-08-18 8:11 ` [PATCH 1/5] stddef: Add flexible array union helper Kees Cook
2021-08-18 8:11 ` [PATCH 2/5] treewide: Replace open-coded flex arrays in unions Kees Cook
2021-08-18 8:11 ` Kees Cook
2021-08-18 9:56 ` Marc Kleine-Budde
2021-08-18 9:56 ` Marc Kleine-Budde
2021-08-18 21:51 ` Kees Cook
2021-08-18 21:51 ` Kees Cook
2021-08-18 8:11 ` [PATCH 3/5] treewide: Replace 0-element memcpy() destinations with flexible arrays Kees Cook
2021-08-18 8:11 ` Kees Cook
2021-08-18 8:11 ` [PATCH 4/5] Makefile: Enable -Warray-bounds Kees Cook
2022-02-02 16:09 ` Guenter Roeck
2022-02-02 20:56 ` Kees Cook
2022-02-02 23:33 ` Guenter Roeck
2022-02-03 3:03 ` Kees Cook [this message]
2022-02-02 22:02 ` Kees Cook
2022-02-02 22:11 ` Kees Cook
2022-02-02 23:21 ` Guenter Roeck
2022-02-03 3:02 ` Kees Cook
2021-08-18 8:11 ` [PATCH 5/5] Makefile: Enable -Wzero-length-bounds Kees Cook
2021-08-25 21:17 ` Nick Desaulniers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202202021902.97BAE673@keescook \
--to=keescook@chromium.org \
--cc=arnd@arndb.de \
--cc=clang-built-linux@googlegroups.com \
--cc=gustavoars@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@roeck-us.net \
--cc=masahiroy@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.