lkml.org 
[lkml]   [2016]   [Oct]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.12 29/84] powerpc/ptrace: Fix out of bounds array access warning
    Date
    From: Khem Raj <raj.khem@gmail.com>

    3.12-stable review patch. If anyone has any objections, please let me know.

    ===============

    commit 1e407ee3b21f981140491d5b8a36422979ca246f upstream.

    gcc-6 correctly warns about a out of bounds access

    arch/powerpc/kernel/ptrace.c:407:24: warning: index 32 denotes an offset greater than size of 'u64[32][1] {aka long long unsigned int[32][1]}' [-Warray-bounds]
    offsetof(struct thread_fp_state, fpr[32][0]));
    ^

    check the end of array instead of beginning of next element to fix this

    Signed-off-by: Khem Raj <raj.khem@gmail.com>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Michael Ellerman <mpe@ellerman.id.au>
    Cc: Segher Boessenkool <segher@kernel.crashing.org>
    Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
    Acked-by: Olof Johansson <olof@lixom.net>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    ---
    arch/powerpc/kernel/ptrace.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
    index 9a0d24c390a3..929cdc0f34f5 100644
    --- a/arch/powerpc/kernel/ptrace.c
    +++ b/arch/powerpc/kernel/ptrace.c
    @@ -376,7 +376,7 @@ static int fpr_get(struct task_struct *target, const struct user_regset *regset,

    #else
    BUILD_BUG_ON(offsetof(struct thread_struct, fpscr) !=
    - offsetof(struct thread_struct, TS_FPR(32)));
    + offsetof(struct thread_struct, fpr[32]));

    return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
    &target->thread.fpr, 0, -1);
    @@ -404,7 +404,7 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,
    return 0;
    #else
    BUILD_BUG_ON(offsetof(struct thread_struct, fpscr) !=
    - offsetof(struct thread_struct, TS_FPR(32)));
    + offsetof(struct thread_struct, fpr[32]));

    return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
    &target->thread.fpr, 0, -1);
    --
    2.10.1
    \
     
     \ /
      Last update: 2016-10-17 10:17    [W:4.155 / U:0.212 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site