From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD602C678D5 for ; Fri, 3 Mar 2023 22:01:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232194AbjCCWA7 (ORCPT ); Fri, 3 Mar 2023 17:00:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231887AbjCCV7c (ORCPT ); Fri, 3 Mar 2023 16:59:32 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D64B76C1BC; Fri, 3 Mar 2023 13:51:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BD9A66194C; Fri, 3 Mar 2023 21:49:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3FDE7C433EF; Fri, 3 Mar 2023 21:49:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1677880198; bh=iq8b04nF1zMkcpSje/nOAgigpgCzK5SdjSEjvNrUvno=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bGppp6yL/S9KsljUjv+y1EFRx/wNEZcXNjW1z4wKlbgswcmJJZxH2ExMLZyj95KOg F3YZWNdhnlyH5BGCsFZxpzLDJmhSfZSsnODSgAYcAKsTWe7jKkk4LFR50+zZhYH/UC UEMQ+5NbMHVJJy5zagKL/F7FtwKHuF5ObBGgTtUAx7XLUSJ/xi3KCwrEZonZhul2En /kyET7ed4OmKD0f/rOxd8K3a/Mv/rfdZyQfqSzB54Cy7G+A2NyZwd3l7gbM57XfrPC fal5RgpRpOs7WGnmbWANiWEEMhAoeJuvkuBe4GCb04lsJqoC4Xyr3bnZCoioX+klc9 TTeMU3+5oArGw== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Kees Cook , Alan Stern , Greg Kroah-Hartman , Sasha Levin , linux-usb@vger.kernel.org, usb-storage@lists.one-eyed-alien.net Subject: [PATCH AUTOSEL 4.14 09/11] USB: ene_usb6250: Allocate enough memory for full object Date: Fri, 3 Mar 2023 16:49:35 -0500 Message-Id: <20230303214938.1454767-9-sashal@kernel.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230303214938.1454767-1-sashal@kernel.org> References: <20230303214938.1454767-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kees Cook [ Upstream commit ce33e64c1788912976b61314b56935abd4bc97ef ] The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index 79f77179fd9b5..08b946d27277a 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -948,7 +948,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.39.2