Commit 28cde8f7 authored Apr 10, 2024 by Arnd Bergmann Committed by openeuler-sync-bot Apr 13, 2024

EDAC/thunderx: Fix possible out-of-bounds string access

stable inclusion
from stable-v5.10.209
commit 6aa7865ba7ff7f0ede0035180fb3b9400ceb405a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EBW
CVE: CVE-2023-52464

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6aa7865ba7ff7f0ede0035180fb3b9400ceb405a



--------------------------------

[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ]

Enabling -Wstringop-overflow globally exposes a warning for a common bug
in the usage of strncat():

  drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':
  drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]
   1136 |                 strncat(msg, other, OCX_MESSAGE_SIZE);
        |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   ...
   1145 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);
   ...
   1150 |                                 strncat(msg, other, OCX_MESSAGE_SIZE);

   ...

Apparently the author of this driver expected strncat() to behave the
way that strlcat() does, which uses the size of the destination buffer
as its third argument rather than the length of the source buffer. The
result is that there is no check on the size of the allocated buffer.

Change it to strlcat().

  [ bp: Trim compiler output, fixup commit message. ]

Fixes: 41003396 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org


Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lu Jialin <lujialin4@huawei.com>
(cherry picked from commit 85727f3d)

parent 883f3511

drivers/edac/thunderx_edac.c

+5 −5

Original line number	Diff line number	Diff line
		@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
		decode_register(other, OCX_OTHER_SIZE,
		ocx_com_errors, ctx->reg_com_int);

		strncat(msg, other, OCX_MESSAGE_SIZE);
		strlcat(msg, other, OCX_MESSAGE_SIZE);

		for (lane = 0; lane < OCX_RX_LANES; lane++)
		if (ctx->reg_com_int & BIT(lane)) {
		@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
		lane, ctx->reg_lane_int[lane],
		lane, ctx->reg_lane_stat11[lane]);

		strncat(msg, other, OCX_MESSAGE_SIZE);
		strlcat(msg, other, OCX_MESSAGE_SIZE);

		decode_register(other, OCX_OTHER_SIZE,
		ocx_lane_errors,
		ctx->reg_lane_int[lane]);
		strncat(msg, other, OCX_MESSAGE_SIZE);
		strlcat(msg, other, OCX_MESSAGE_SIZE);
		}

		if (ctx->reg_com_int & OCX_COM_INT_CE)
		@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)
		decode_register(other, OCX_OTHER_SIZE,
		ocx_com_link_errors, ctx->reg_com_link_int);

		strncat(msg, other, OCX_MESSAGE_SIZE);
		strlcat(msg, other, OCX_MESSAGE_SIZE);

		if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE)
		edac_device_handle_ue(ocx->edac_dev, 0, 0, msg);
		@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)

		decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int);

		strncat(msg, other, L2C_MESSAGE_SIZE);
		strlcat(msg, other, L2C_MESSAGE_SIZE);

		if (ctx->reg_int & mask_ue)
		edac_device_handle_ue(l2c->edac_dev, 0, 0, msg);