OpenCloudOS-Kernel/drivers/usb/serial
Kees Cook e23e50e7ac USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS
The sizeof(struct whitehat_dr_info) can be 4 bytes under CONFIG_AEABI=n
due to "-mabi=apcs-gnu", even though it has a single u8:

whiteheat_private {
        __u8                       mcr;                  /*     0     1 */

        /* size: 4, cachelines: 1, members: 1 */
        /* padding: 3 */
        /* last cacheline: 4 bytes */
};

The result is technically harmless, as both the source and the
destinations are currently the same allocation size (4 bytes) and don't
use their padding, but if anything were to ever be added after the
"mcr" member in "struct whiteheat_private", it would be overwritten. The
structs both have a single u8 "mcr" member, but are 4 bytes in padded
size. The memcpy() destination was explicitly targeting the u8 member
(size 1) with the length of the whole structure (size 4), triggering
the memcpy buffer overflow warning:

In file included from include/linux/string.h:253,
                 from include/linux/bitmap.h:11,
                 from include/linux/cpumask.h:12,
                 from include/linux/smp.h:13,
                 from include/linux/lockdep.h:14,
                 from include/linux/spinlock.h:62,
                 from include/linux/mmzone.h:8,
                 from include/linux/gfp.h:6,
                 from include/linux/slab.h:15,
                 from drivers/usb/serial/whiteheat.c:17:
In function 'fortify_memcpy_chk',
    inlined from 'firm_send_command' at drivers/usb/serial/whiteheat.c:587:4:
include/linux/fortify-string.h:328:25: warning: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
  328 |                         __write_overflow_field(p_size_field, size);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Instead, just assign the one byte directly.

Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/202204142318.vDqjjSFn-lkp@intel.com
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220421001234.2421107-1-keescook@chromium.org
Signed-off-by: Johan Hovold <johan@kernel.org>
2022-04-21 10:08:06 +02:00
..
Kconfig USB: serial: simple: add Nokia phone driver 2022-03-03 09:27:36 +01:00
Makefile USB: serial: add MaxLinear/Exar USB to Serial driver 2021-01-21 10:49:37 +01:00
Makefile-keyspan_pda_fw
aircable.c USB: serial: drop redundant transfer-buffer casts 2020-07-09 09:20:17 +02:00
ark3116.c USB: serial: make use of UART_LCR_WLEN() + tty_get_char_size() 2022-02-28 21:49:06 +01:00
belkin_sa.c tty: make use of tty_get_{char,frame}_size 2021-06-15 14:03:27 +02:00
belkin_sa.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
bus.c bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
ch341.c Revert "USB: serial: ch341: add new Product ID for CH341A" 2022-02-21 09:58:14 +01:00
console.c USB: serial: console: add support for flow control 2020-07-02 10:38:45 +02:00
cp210x.c USB: serial: cp210x: add PIDs for Kamstrup USB Meter Reader 2022-04-20 09:19:42 +02:00
cyberjack.c USB: serial: make usb_serial_driver::write_room return uint 2021-05-19 10:56:40 +02:00
cypress_m8.c USB: serial: replace symbolic permissions by octal permissions 2021-08-26 09:38:27 +02:00
cypress_m8.h USB: serial: cypress_m8: enable Simply Automated UPB PIM 2020-06-23 09:56:17 +02:00
digi_acceleport.c USB: serial: drop irq-flags initialisations 2021-05-21 15:46:25 +02:00
empeg.c docs: usb: rename files to .rst and add them to drivers-api 2019-06-20 14:28:36 +02:00
ezusb_convert.pl
f81232.c USB: serial: make use of UART_LCR_WLEN() + tty_get_char_size() 2022-02-28 21:49:06 +01:00
f81534.c USB: serial: make use of UART_LCR_WLEN() + tty_get_char_size() 2022-02-28 21:49:06 +01:00
ftdi_sio.c USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 2022-02-01 11:53:43 +01:00
ftdi_sio.h USB: Fix up terminology 2020-07-01 14:04:04 +02:00
ftdi_sio_ids.h USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320 2022-02-01 11:53:43 +01:00
garmin_gps.c USB: serial: replace symbolic permissions by octal permissions 2021-08-26 09:38:27 +02:00
generic.c USB: serial: make usb_serial_driver::chars_in_buffer return uint 2021-05-19 10:56:41 +02:00
io_16654.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
io_edgeport.c USB: serial: io_edgeport: drop unused descriptor helper 2021-07-30 17:15:39 +02:00
io_edgeport.h USB: serial: io_edgeport: drop unused definitions 2021-04-08 09:50:04 +02:00
io_ionsp.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
io_ti.c USB: serial: replace symbolic permissions by octal permissions 2021-08-26 09:38:27 +02:00
io_ti.h USB: serial: io_ti: drop unnecessary packed attributes 2021-04-13 18:23:34 +02:00
io_usbvend.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
ipaq.c USB: serial: replace symbolic permissions by octal permissions 2021-08-26 09:38:27 +02:00
ipw.c
ir-usb.c USB: serial: make usb_serial_driver::write_room return uint 2021-05-19 10:56:40 +02:00
iuu_phoenix.c USB: serial: replace symbolic permissions by octal permissions 2021-08-26 09:38:27 +02:00
iuu_phoenix.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
keyspan.c USB: serial: keyspan: fix memleak on probe errors 2021-10-27 15:18:59 +02:00
keyspan_pda.c USB: serial: keyspan_pda: use usb_control_msg_recv() 2021-09-21 14:23:23 +02:00
keyspan_usa26msg.h
keyspan_usa28msg.h
keyspan_usa49msg.h
keyspan_usa67msg.h
keyspan_usa90msg.h
kl5kusb105.c USB: serial: kl5kusb105: drop line-status helper 2021-09-22 09:33:17 +02:00
kl5kusb105.h
kobil_sct.c USB: serial: make usb_serial_driver::write_room return uint 2021-05-19 10:56:40 +02:00
kobil_sct.h
mct_u232.c USB: serial: make remove callback return void 2021-02-09 13:13:58 +01:00
mct_u232.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
metro-usb.c USB: serial: drop irq-flags initialisations 2021-05-21 15:46:25 +02:00
mos7720.c USB: serial: make use of UART_LCR_WLEN() + tty_get_char_size() 2022-02-28 21:49:06 +01:00
mos7840.c USB: serial: mos7840: remove duplicated 0xac24 device ID 2021-09-20 11:19:55 +02:00
mxuport.c USB: serial: mxuport: drop short control-transfer check 2021-01-18 14:26:14 +01:00
navman.c
omninet.c USB: serial: omninet: update driver description 2021-05-25 08:59:17 +02:00
opticon.c USB: serial: make usb_serial_driver::chars_in_buffer return uint 2021-05-19 10:56:41 +02:00
option.c USB: serial: option: add support for Cinterion MV32-WA/MV32-WB 2022-04-20 09:12:34 +02:00
oti6858.c USB: serial: make usb_serial_driver::chars_in_buffer return uint 2021-05-19 10:56:41 +02:00
oti6858.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
pl2303.c USB: serial: pl2303: fix GS type detection 2022-03-07 15:41:29 +01:00
pl2303.h USB: serial: pl2303: add IBM device IDs 2022-03-04 09:52:09 +01:00
qcaux.c
qcserial.c USB: serial: qcserial: add EM9191 QDL support 2021-10-07 15:39:06 +02:00
quatech2.c USB: serial: make use of UART_LCR_WLEN() + tty_get_char_size() 2022-02-28 21:49:06 +01:00
safe_serial.c
sierra.c USB: serial: replace symbolic permissions by octal permissions 2021-08-26 09:38:27 +02:00
spcp8x5.c USB: serial: make remove callback return void 2021-02-09 13:13:58 +01:00
ssu100.c USB: serial: make use of UART_LCR_WLEN() + tty_get_char_size() 2022-02-28 21:49:06 +01:00
symbolserial.c USB: serial: make remove callback return void 2021-02-09 13:13:58 +01:00
ti_usb_3410_5052.c USB-serial updates for 5.14-rc1 2021-06-24 12:54:28 +02:00
upd78f0730.c USB: serial: do not use tty class device for debugging 2021-04-09 17:55:21 +02:00
usb-serial-simple.c USB: serial: simple: add Nokia phone driver 2022-03-03 09:27:36 +01:00
usb-serial.c USB: serial: allow hung up ports to be suspended 2021-09-20 11:49:34 +02:00
usb-wwan.h USB: serial: make usb_serial_driver::chars_in_buffer return uint 2021-05-19 10:56:41 +02:00
usb_debug.c
usb_wwan.c USB: serial: usb_wwan: remove redundant assignment to variable i 2022-03-08 18:51:02 +01:00
visor.c docs: usb: rename files to .rst and add them to drivers-api 2019-06-20 14:28:36 +02:00
visor.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
whiteheat.c USB: serial: whiteheat: fix heap overflow in WHITEHEAT_GET_DTR_RTS 2022-04-21 10:08:06 +02:00
whiteheat.h USB: serial: Use the correct style for SPDX License Identifier 2020-04-22 09:26:47 +02:00
wishbone-serial.c
xr_serial.c USB: serial: xr: add copyright notice 2021-04-13 18:36:39 +02:00
xsens_mt.c