Messages in this thread | ![/](/images/icornerl.gif) | | Date | Sat, 18 May 2024 13:21:55 -0700 | From | Kees Cook <> | Subject | Re: [PATCH v2] drm/nouveau/nvif: Avoid build error due to potential integer overflows |
| |
On Sat, May 18, 2024 at 11:29:23AM -0700, Guenter Roeck wrote: > Trying to build parisc:allmodconfig with gcc 12.x or later results > in the following build error. > > drivers/gpu/drm/nouveau/nvif/object.c: In function 'nvif_object_mthd': > drivers/gpu/drm/nouveau/nvif/object.c:161:9: error: > 'memcpy' accessing 4294967264 or more bytes at offsets 0 and 32 overlaps 6442450881 bytes at offset -2147483617 [-Werror=restrict] > 161 | memcpy(data, args->mthd.data, size); > | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > drivers/gpu/drm/nouveau/nvif/object.c: In function 'nvif_object_ctor': > drivers/gpu/drm/nouveau/nvif/object.c:298:17: error: > 'memcpy' accessing 4294967240 or more bytes at offsets 0 and 56 overlaps 6442450833 bytes at offset -2147483593 [-Werror=restrict] > 298 | memcpy(data, args->new.data, size); > > gcc assumes that 'sizeof(*args) + size' can overflow, which would result > in the problem. > > The problem is not new, only it is now no longer a warning but an error > since W=1 has been enabled for the drm subsystem and since Werror is > enabled for test builds. > > Rearrange arithmetic and use check_add_overflow() for validating the > allocation size to avoid the overflow. > > Fixes: a61ddb4393ad ("drm: enable (most) W=1 warnings by default across the subsystem") > Cc: Javier Martinez Canillas <javierm@redhat.com> > Cc: Jani Nikula <jani.nikula@intel.com> > Cc: Thomas Zimmermann <tzimmermann@suse.de> > Cc: Danilo Krummrich <dakr@redhat.com> > Cc: Maxime Ripard <mripard@kernel.org> > Cc: Kees Cook <keescook@chromium.org> > Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr> > Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Yeah, looks good to me. Thanks!
Reviewed-by: Kees Cook <keescook@chromium.org>
-- Kees Cook
| ![\](/images/icornerr.gif) |