1
0
Fork 0
alistair23-linux/drivers/tty
Stephen Rothwell 01c9e2a9fc tty: evh_bytechan: Fix out of bounds accesses
commit 3670664b5d upstream.

ev_byte_channel_send() assumes that its third argument is a 16 byte
array. Some places where it is called it may not be (or we can't
easily tell if it is). Newer compilers have started producing warnings
about this, so make sure we actually pass a 16 byte array.

There may be more elegant solutions to this, but the driver is quite
old and hasn't been updated in many years.

The warnings (from a powerpc allyesconfig build) are:

  In file included from include/linux/byteorder/big_endian.h:5,
                   from arch/powerpc/include/uapi/asm/byteorder.h:14,
                   from include/asm-generic/bitops/le.h:6,
                   from arch/powerpc/include/asm/bitops.h:250,
                   from include/linux/bitops.h:29,
                   from include/linux/kernel.h:12,
                   from include/asm-generic/bug.h:19,
                   from arch/powerpc/include/asm/bug.h:109,
                   from include/linux/bug.h:5,
                   from include/linux/mmdebug.h:5,
                   from include/linux/gfp.h:5,
                   from include/linux/slab.h:15,
                   from drivers/tty/ehv_bytechan.c:24:
  drivers/tty/ehv_bytechan.c: In function ‘ehv_bc_udbg_putc’:
  arch/powerpc/include/asm/epapr_hcalls.h:298:20: warning: array subscript 1 is outside array bounds of ‘const char[1]’ [-Warray-bounds]
    298 |  r6 = be32_to_cpu(p[1]);
  include/uapi/linux/byteorder/big_endian.h:40:51: note: in definition of macro ‘__be32_to_cpu’
     40 | #define __be32_to_cpu(x) ((__force __u32)(__be32)(x))
        |                                                   ^
  arch/powerpc/include/asm/epapr_hcalls.h:298:7: note: in expansion of macro ‘be32_to_cpu’
    298 |  r6 = be32_to_cpu(p[1]);
        |       ^~~~~~~~~~~
  drivers/tty/ehv_bytechan.c:166:13: note: while referencing ‘data’
    166 | static void ehv_bc_udbg_putc(char c)
        |             ^~~~~~~~~~~~~~~~

Fixes: dcd83aaff1 ("tty/powerpc: introduce the ePAPR embedded hypervisor byte channel driver")
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Tested-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
[mpe: Trim warnings from change log]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200109183912.5fcb52aa@canb.auug.org.au
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-23 10:36:44 +02:00
..
hvc tty: hvcs: Fix odd use of strlcpy 2019-09-04 12:43:44 +02:00
ipwireless tty: add SPDX identifiers to Kconfig and Makefiles 2019-04-04 18:48:43 +02:00
serdev serdev: ttyport: restore client ops on deregistration 2020-02-28 17:22:19 +01:00
serial serial: sprd: Fix a dereference warning 2020-04-02 15:10:59 +02:00
vt vt: vt_ioctl: fix use-after-free in vt_in_use() 2020-04-02 15:11:00 +02:00
Kconfig docs: serial: move it to the driver-api 2019-07-15 11:03:03 -03:00
Makefile tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
amiserial.c
cyclades.c
ehv_bytechan.c tty: evh_bytechan: Fix out of bounds accesses 2020-04-23 10:36:44 +02:00
goldfish.c
isicom.c tty/isicom: remove redundant assignment to variable word_count 2019-09-04 12:43:44 +02:00
mips_ejtag_fdc.c
moxa.c
moxa.h
mxser.c
mxser.h
n_gsm.c tty: n_gsm: avoid recursive locking with async port hangup 2019-09-04 12:43:56 +02:00
n_hdlc.c tty: n_hdlc: fix build on SPARC 2019-10-04 15:14:20 +02:00
n_null.c
n_r3964.c tty: Don't block on IO when ldisc change is pending 2018-12-05 12:16:33 +01:00
n_tracerouter.c
n_tracesink.c
n_tracesink.h
n_tty.c n_tty: check for negative and zero space return from tty_write_room 2019-04-16 15:21:33 +02:00
nozomi.c tty: nozomi: Use dev_get_drvdata 2019-09-04 12:43:44 +02:00
pty.c Revert "tty: pty: Fix race condition between release_one_tty and pty_write" 2019-03-29 15:47:40 +01:00
rocket.c TTY/Serial patches for 5.2-rc1 2019-05-08 10:07:28 -07:00
rocket.h tty: rocket: Remove RCPK_GET_STRUCT ioctl 2019-04-25 11:58:56 +02:00
rocket_int.h
synclink.c tty/synclink: remove ISA support 2019-02-12 08:51:33 +01:00
synclink_gt.c tty: synclink_gt: Adjust indentation in several functions 2020-02-24 08:36:47 +01:00
synclinkmp.c tty: synclinkmp: Adjust indentation in several functions 2020-02-24 08:36:47 +01:00
sysrq.c panic: avoid the extra noise dmesg 2019-05-14 19:52:51 -07:00
tty_audit.c audit: join tty records to their syscall 2019-02-07 21:33:54 -05:00
tty_baudrate.c
tty_buffer.c tty: increase the default flip buffer limit to 2*640K 2019-01-30 12:03:58 +01:00
tty_io.c tty: fix compat TIOCGSERIAL checking wrong function ptr 2020-03-25 08:25:52 +01:00
tty_ioctl.c
tty_jobctrl.c tty: fix read of tty->pgrp outside of ctrl_lock 2019-03-28 01:28:23 +09:00
tty_ldisc.c proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
tty_ldsem.c tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop 2019-07-25 15:39:24 +02:00
tty_mutex.c
tty_port.c serdev: ttyport: restore client ops on deregistration 2020-02-28 17:22:19 +01:00
ttynull.c tty: Add NULL TTY driver 2019-04-16 15:21:34 +02:00
vcc.c tty: fix up a few remaining files without SPDX identifiers 2019-04-04 18:48:43 +02:00