From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E732CD612F for ; Mon, 9 Oct 2023 20:43:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378014AbjJIUnR (ORCPT ); Mon, 9 Oct 2023 16:43:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38582 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1378008AbjJIUnQ (ORCPT ); Mon, 9 Oct 2023 16:43:16 -0400 Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C4CF1A3 for ; Mon, 9 Oct 2023 13:43:14 -0700 (PDT) Received: by mail-pl1-x633.google.com with SMTP id d9443c01a7336-1c6219307b2so29606345ad.1 for ; Mon, 09 Oct 2023 13:43:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1696884194; x=1697488994; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=wxz37O2Et+/sEGfnnd7+X/Fbves+7FcqdtNnLD8idyE=; b=H++RnMwydgF8xDS9VP8Ht3XKsJsU0rA2UQBgh6b8h2pLI7LSjWBy5vxR307+cK+6f9 UevaIdvoR3oJkqY43KkVSU8R8UEfqbjb4WzXBmZ82DYon+QtfeNiUGkWcs6QHP+rTFKX szbIEE2vdtwtDzsqUBuoEzi/Dlqu1T0z2ctT4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1696884194; x=1697488994; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=wxz37O2Et+/sEGfnnd7+X/Fbves+7FcqdtNnLD8idyE=; b=HS3MDAnzpF4s8wU606h4Uxi8dBdbnOByMNtLpSm19Daffz5iBT7i6EAVAn8Nxk6DNw gJR1ltidsronjPpgleFk9gjCf0qAwT8r5Ml9+n3nC/vzImbOXsWqDel9k8pi1F5F2mCt 35uMJTdECSOJ1rWznBoDZ9FfzWgBiym1EXfk19v+WGNn/B48qpsjfyAjStuhcuNtkS5q lFaXi82jlLF7btfS21SfpZ+lvJRkLyuX0RFleKVPHqsnNfSmrPI8Cr1v6nyfMiu6ug5W +/gT3jufQzlJ6zKgrKpwKDXIikaKKXAmQYJc3ulM1heiIHoxn6kmT7TJ8lodh2anTwNF bRMQ== X-Gm-Message-State: AOJu0YwNULbiCnkFsCvAzkEyBA/Dy6gcQ1RFJT3WlQRTvIaoJSrQedrM Qmz1eDG9+cQsfghD7nppXv9+Pg== X-Google-Smtp-Source: AGHT+IHpl+jUNGx7N5orhdDTiKGl0l5fjOovy9ReFhg+kLarFO3onKx6wpsiy5cN1Kn/lsnAHiFI0A== X-Received: by 2002:a17:903:11d2:b0:1b8:8b72:fa28 with SMTP id q18-20020a17090311d200b001b88b72fa28mr16257836plh.58.1696884194272; Mon, 09 Oct 2023 13:43:14 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id ij8-20020a170902ab4800b001c1f161949fsm10270953plb.96.2023.10.09.13.43.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 09 Oct 2023 13:43:13 -0700 (PDT) Date: Mon, 9 Oct 2023 13:43:12 -0700 From: Kees Cook To: Arnd Bergmann Cc: Marcel Holtmann , Johan Hedberg , Luiz Augusto von Dentz , "Lee, Chun-Yi" , Arnd Bergmann , Luiz Augusto von Dentz , stable@vger.kernel.org, Iulia Tanasescu , Pauli Virtanen , Jakub Kicinski , Claudia Draghicescu , linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] [v2] Bluetooth: avoid memcmp() out of bounds warning Message-ID: <202310091342.C99D7BF@keescook> References: <20231009203137.3125516-1-arnd@kernel.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231009203137.3125516-1-arnd@kernel.org> Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Mon, Oct 09, 2023 at 10:31:31PM +0200, Arnd Bergmann wrote: > From: Arnd Bergmann > > bacmp() is a wrapper around memcpy(), which contain compile-time > checks for buffer overflow. Since the hci_conn_request_evt() also calls > bt_dev_dbg() with an implicit NULL pointer check, the compiler is now > aware of a case where 'hdev' is NULL and treats this as meaning that > zero bytes are available: > > In file included from net/bluetooth/hci_event.c:32: > In function 'bacmp', > inlined from 'hci_conn_request_evt' at net/bluetooth/hci_event.c:3276:7: > include/net/bluetooth/bluetooth.h:364:16: error: 'memcmp' specified bound 6 exceeds source size 0 [-Werror=stringop-overread] > 364 | return memcmp(ba1, ba2, sizeof(bdaddr_t)); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Add another NULL pointer check before the bacmp() to ensure the compiler > understands the code flow enough to not warn about it. Since the patch > that introduced the warning is marked for stable backports, this one > should also go that way to avoid introducing build regressions. > > Fixes: d70e44fef8621 ("Bluetooth: Reject connection with the device which has same BD_ADDR") > Cc: Kees Cook > Cc: "Lee, Chun-Yi" > Cc: Luiz Augusto von Dentz > Cc: Marcel Holtmann > Cc: stable@vger.kernel.org > Signed-off-by: Arnd Bergmann A weird side-effect of the NULL check, but not unreasonable. :) Reviewed-by: Kees Cook -- Kees Cook