• Kees Cook's avatar
    nouveau/gsp: Avoid addressing beyond end of rpc->entries · 838ae9f4
    Kees Cook authored
    Using the end of rpc->entries[] for addressing runs into both compile-time
    and run-time detection of accessing beyond the end of the array. Use the
    base pointer instead, since was allocated with the additional bytes for
    storing the strings. Avoids the following warning in future GCC releases
    with support for __counted_by:
    
    In function 'fortify_memcpy_chk',
        inlined from 'r535_gsp_rpc_set_registry' at ../drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1123:3:
    ../include/linux/fortify-string.h:553:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
      553 |                         __write_overflow_field(p_size_field, size);
          |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    
    for this code:
    
    	strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES];
    	...
                    memcpy(strings, r535_registry_entries[i].name, name_len);
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Signed-off-by: default avatarDanilo Krummrich <dakr@redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20240330141159.work.063-kees@kernel.org
    838ae9f4
r535.c 61.9 KB