* [PATCH] firmware: coreboot: Check size of table entry and split memcpy
@ 2023-01-06 4:53 Kees Cook
2023-01-06 15:03 ` Julius Werner
0 siblings, 1 reply; 4+ messages in thread
From: Kees Cook @ 2023-01-06 4:53 UTC (permalink / raw)
To: Jack Rosenthal
Cc: Kees Cook, Paul Menzel, Guenter Roeck, Julius Werner,
Brian Norris, Stephen Boyd, Greg Kroah-Hartman, linux-kernel,
linux-hardening
The memcpy() of the data following a coreboot_table_entry couldn't be
evaluated by the compiler under CONFIG_FORTIFY_SOURCE. To make it easier
to reason about, add an explicit flexible array member to struct
coreboot_table_entry, and validate the sizes before copying. Avoids this
run-time false positive warning:
memcpy: detected field-spanning write (size 168) of single field "&device->entry" at drivers/firmware/google/coreboot_table.c:103 (size 8)
Reported-by: Paul Menzel <pmenzel@molgen.mpg.de>
Link: https://lore.kernel.org/all/03ae2704-8c30-f9f0-215b-7cdf4ad35a9a@molgen.mpg.de/
Cc: Jack Rosenthal <jrosenth@chromium.org>
Cc: Guenter Roeck <groeck@chromium.org>
Cc: Julius Werner <jwerner@chromium.org>
Cc: Brian Norris <briannorris@chromium.org>
Cc: Stephen Boyd <swboyd@chromium.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/firmware/google/coreboot_table.c | 8 +++++++-
drivers/firmware/google/coreboot_table.h | 1 +
2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
index 2652c396c423..102edfb4eb7b 100644
--- a/drivers/firmware/google/coreboot_table.c
+++ b/drivers/firmware/google/coreboot_table.c
@@ -93,6 +93,11 @@ static int coreboot_table_populate(struct device *dev, void *ptr)
for (i = 0; i < header->table_entries; i++) {
entry = ptr_entry;
+ if (entry->size < sizeof(*entry)) {
+ dev_warn(dev, "coreboot table entry too small!\n");
+ return -EINVAL;
+ }
+
device = kzalloc(sizeof(struct device) + entry->size, GFP_KERNEL);
if (!device)
return -ENOMEM;
@@ -100,7 +105,8 @@ static int coreboot_table_populate(struct device *dev, void *ptr)
device->dev.parent = dev;
device->dev.bus = &coreboot_bus_type;
device->dev.release = coreboot_device_release;
- memcpy(&device->entry, ptr_entry, entry->size);
+ device->entry = *entry;
+ memcpy(device->entry.data, entry->data, entry->size - sizeof(*entry));
switch (device->entry.tag) {
case LB_TAG_CBMEM_ENTRY:
diff --git a/drivers/firmware/google/coreboot_table.h b/drivers/firmware/google/coreboot_table.h
index 37f4d335a606..2a2cea79204b 100644
--- a/drivers/firmware/google/coreboot_table.h
+++ b/drivers/firmware/google/coreboot_table.h
@@ -29,6 +29,7 @@ struct coreboot_table_header {
struct coreboot_table_entry {
u32 tag;
u32 size;
+ u8 data[]; /* Size here is: "size - (sizeof(u32) * 2)" */
};
/* Points to a CBMEM entry */
--
2.34.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] firmware: coreboot: Check size of table entry and split memcpy
2023-01-06 4:53 [PATCH] firmware: coreboot: Check size of table entry and split memcpy Kees Cook
@ 2023-01-06 15:03 ` Julius Werner
2023-01-06 20:34 ` Kees Cook
0 siblings, 1 reply; 4+ messages in thread
From: Julius Werner @ 2023-01-06 15:03 UTC (permalink / raw)
To: Kees Cook
Cc: Jack Rosenthal, Paul Menzel, Guenter Roeck, Julius Werner,
Brian Norris, Stephen Boyd, Greg Kroah-Hartman, linux-kernel,
linux-hardening
Have you considered adding the flexible array member directly to the
union in struct coreboot_device instead? I think that would make this
a bit simpler by not having to copy header and data portion
separately.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] firmware: coreboot: Check size of table entry and split memcpy
2023-01-06 15:03 ` Julius Werner
@ 2023-01-06 20:34 ` Kees Cook
2023-01-06 22:27 ` Julius Werner
0 siblings, 1 reply; 4+ messages in thread
From: Kees Cook @ 2023-01-06 20:34 UTC (permalink / raw)
To: Julius Werner
Cc: Jack Rosenthal, Paul Menzel, Guenter Roeck, Brian Norris,
Stephen Boyd, Greg Kroah-Hartman, linux-kernel, linux-hardening
On Fri, Jan 06, 2023 at 04:03:35PM +0100, Julius Werner wrote:
> Have you considered adding the flexible array member directly to the
> union in struct coreboot_device instead? I think that would make this
> a bit simpler by not having to copy header and data portion
> separately.
Are you thinking something like this?
diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
index 2652c396c423..564a3c908838 100644
--- a/drivers/firmware/google/coreboot_table.c
+++ b/drivers/firmware/google/coreboot_table.c
@@ -93,14 +93,19 @@ static int coreboot_table_populate(struct device *dev, void *ptr)
for (i = 0; i < header->table_entries; i++) {
entry = ptr_entry;
- device = kzalloc(sizeof(struct device) + entry->size, GFP_KERNEL);
+ if (entry->size < sizeof(*entry)) {
+ dev_warn(dev, "coreboot table entry too small!\n");
+ return -EINVAL;
+ }
+
+ device = kzalloc(sizeof(device->dev) + entry->size, GFP_KERNEL);
if (!device)
return -ENOMEM;
device->dev.parent = dev;
device->dev.bus = &coreboot_bus_type;
device->dev.release = coreboot_device_release;
- memcpy(&device->entry, ptr_entry, entry->size);
+ memcpy(device->raw, entry, entry->size);
switch (device->entry.tag) {
case LB_TAG_CBMEM_ENTRY:
diff --git a/drivers/firmware/google/coreboot_table.h b/drivers/firmware/google/coreboot_table.h
index 37f4d335a606..d814dca33a08 100644
--- a/drivers/firmware/google/coreboot_table.h
+++ b/drivers/firmware/google/coreboot_table.h
@@ -79,6 +79,7 @@ struct coreboot_device {
struct lb_cbmem_ref cbmem_ref;
struct lb_cbmem_entry cbmem_entry;
struct lb_framebuffer framebuffer;
+ DECLARE_FLEX_ARRAY(u8, raw);
};
};
--
Kees Cook
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] firmware: coreboot: Check size of table entry and split memcpy
2023-01-06 20:34 ` Kees Cook
@ 2023-01-06 22:27 ` Julius Werner
0 siblings, 0 replies; 4+ messages in thread
From: Julius Werner @ 2023-01-06 22:27 UTC (permalink / raw)
To: Kees Cook
Cc: Julius Werner, Jack Rosenthal, Paul Menzel, Guenter Roeck,
Brian Norris, Stephen Boyd, Greg Kroah-Hartman, linux-kernel,
linux-hardening
Yeah, exactly. Isn't that a bit simpler? (I wasn't aware of the
flexible array member in union issue, but it sounds like we have a
neat solution for that already.)
On Fri, Jan 6, 2023 at 9:35 PM Kees Cook <keescook@chromium.org> wrote:
>
> On Fri, Jan 06, 2023 at 04:03:35PM +0100, Julius Werner wrote:
> > Have you considered adding the flexible array member directly to the
> > union in struct coreboot_device instead? I think that would make this
> > a bit simpler by not having to copy header and data portion
> > separately.
>
> Are you thinking something like this?
>
>
> diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
> index 2652c396c423..564a3c908838 100644
> --- a/drivers/firmware/google/coreboot_table.c
> +++ b/drivers/firmware/google/coreboot_table.c
> @@ -93,14 +93,19 @@ static int coreboot_table_populate(struct device *dev, void *ptr)
> for (i = 0; i < header->table_entries; i++) {
> entry = ptr_entry;
>
> - device = kzalloc(sizeof(struct device) + entry->size, GFP_KERNEL);
> + if (entry->size < sizeof(*entry)) {
> + dev_warn(dev, "coreboot table entry too small!\n");
> + return -EINVAL;
> + }
> +
> + device = kzalloc(sizeof(device->dev) + entry->size, GFP_KERNEL);
> if (!device)
> return -ENOMEM;
>
> device->dev.parent = dev;
> device->dev.bus = &coreboot_bus_type;
> device->dev.release = coreboot_device_release;
> - memcpy(&device->entry, ptr_entry, entry->size);
> + memcpy(device->raw, entry, entry->size);
>
> switch (device->entry.tag) {
> case LB_TAG_CBMEM_ENTRY:
> diff --git a/drivers/firmware/google/coreboot_table.h b/drivers/firmware/google/coreboot_table.h
> index 37f4d335a606..d814dca33a08 100644
> --- a/drivers/firmware/google/coreboot_table.h
> +++ b/drivers/firmware/google/coreboot_table.h
> @@ -79,6 +79,7 @@ struct coreboot_device {
> struct lb_cbmem_ref cbmem_ref;
> struct lb_cbmem_entry cbmem_entry;
> struct lb_framebuffer framebuffer;
> + DECLARE_FLEX_ARRAY(u8, raw);
> };
> };
>
>
> --
> Kees Cook
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-01-06 22:31 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-06 4:53 [PATCH] firmware: coreboot: Check size of table entry and split memcpy Kees Cook
2023-01-06 15:03 ` Julius Werner
2023-01-06 20:34 ` Kees Cook
2023-01-06 22:27 ` Julius Werner
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox