| Message ID | 20210818060533.3569517-56-keescook@chromium.org |
|---|---|
| State | New |
| Headers | show |
| Series | Introduce strict memcpy() bounds checking | expand |
On Tue, 17 Aug 2021, Kees Cook wrote: > In preparation for FORTIFY_SOURCE performing compile-time and run-time > field bounds checking for memset(), avoid intentionally writing across > neighboring fields. > > Add struct_group() to mark region of struct kone_mouse_event that should > be initialized to zero. > > Cc: Stefan Achatz <erazor_de@users.sourceforge.net> > Cc: Jiri Kosina <jikos@kernel.org> > Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> > Cc: linux-input@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> Applied, thank you Kees.
On Fri, 20 Aug 2021, Kees Cook wrote: > > > In preparation for FORTIFY_SOURCE performing compile-time and run-time > > > field bounds checking for memset(), avoid intentionally writing across > > > neighboring fields. > > > > > > Add struct_group() to mark region of struct kone_mouse_event that should > > > be initialized to zero. > > > > > > Cc: Stefan Achatz <erazor_de@users.sourceforge.net> > > > Cc: Jiri Kosina <jikos@kernel.org> > > > Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> > > > Cc: linux-input@vger.kernel.org > > > Signed-off-by: Kees Cook <keescook@chromium.org> > > > > Applied, thank you Kees. > > > > Eek! No, this will break the build: struct_group() is not yet in the tree. > I can carry this with an Ack, etc. I was pretty sure I saw struct_group() already in linux-next, but that was apparently a vacation-induced brainfart, sorry. Dropping.
On Fri, Aug 20, 2021 at 05:27:35PM +0200, Jiri Kosina wrote: > On Fri, 20 Aug 2021, Kees Cook wrote: > > > > > In preparation for FORTIFY_SOURCE performing compile-time and run-time > > > > field bounds checking for memset(), avoid intentionally writing across > > > > neighboring fields. > > > > > > > > Add struct_group() to mark region of struct kone_mouse_event that should > > > > be initialized to zero. > > > > > > > > Cc: Stefan Achatz <erazor_de@users.sourceforge.net> > > > > Cc: Jiri Kosina <jikos@kernel.org> > > > > Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> > > > > Cc: linux-input@vger.kernel.org > > > > Signed-off-by: Kees Cook <keescook@chromium.org> > > > > > > Applied, thank you Kees. > > > > > > > Eek! No, this will break the build: struct_group() is not yet in the tree. > > I can carry this with an Ack, etc. > > I was pretty sure I saw struct_group() already in linux-next, but that was > apparently a vacation-induced brainfart, sorry. Dropping. Cool, no worries. Sorry for the confusion!
On Fri, Aug 20, 2021 at 05:27:35PM +0200, Jiri Kosina wrote: > On Fri, 20 Aug 2021, Kees Cook wrote: > > > > > In preparation for FORTIFY_SOURCE performing compile-time and run-time > > > > field bounds checking for memset(), avoid intentionally writing across > > > > neighboring fields. > > > > > > > > Add struct_group() to mark region of struct kone_mouse_event that should > > > > be initialized to zero. > > > > > > > > Cc: Stefan Achatz <erazor_de@users.sourceforge.net> > > > > Cc: Jiri Kosina <jikos@kernel.org> > > > > Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> > > > > Cc: linux-input@vger.kernel.org > > > > Signed-off-by: Kees Cook <keescook@chromium.org> > > > > > > Applied, thank you Kees. > > > > > > > Eek! No, this will break the build: struct_group() is not yet in the tree. > > I can carry this with an Ack, etc. > > I was pretty sure I saw struct_group() already in linux-next, but that was > apparently a vacation-induced brainfart, sorry. Dropping. Oh, for these two patches, can I add your Acked-by while I carry them? Thanks!
On Fri, 20 Aug 2021, Kees Cook wrote: > > > > > In preparation for FORTIFY_SOURCE performing compile-time and run-time > > > > > field bounds checking for memset(), avoid intentionally writing across > > > > > neighboring fields. > > > > > > > > > > Add struct_group() to mark region of struct kone_mouse_event that should > > > > > be initialized to zero. > > > > > > > > > > Cc: Stefan Achatz <erazor_de@users.sourceforge.net> > > > > > Cc: Jiri Kosina <jikos@kernel.org> > > > > > Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> > > > > > Cc: linux-input@vger.kernel.org > > > > > Signed-off-by: Kees Cook <keescook@chromium.org> > > > > > > > > Applied, thank you Kees. > > > > > > > > > > Eek! No, this will break the build: struct_group() is not yet in the tree. > > > I can carry this with an Ack, etc. > > > > I was pretty sure I saw struct_group() already in linux-next, but that was > > apparently a vacation-induced brainfart, sorry. Dropping. > > Oh, for these two patches, can I add your Acked-by while I carry them? Yes, thanks, and sorry for the noise.
diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c index 1ca64481145e..ea17abc7ad52 100644 --- a/drivers/hid/hid-roccat-kone.c +++ b/drivers/hid/hid-roccat-kone.c @@ -857,7 +857,7 @@ static int kone_raw_event(struct hid_device *hdev, struct hid_report *report, memcpy(&kone->last_mouse_event, event, sizeof(struct kone_mouse_event)); else - memset(&event->tilt, 0, 5); + memset(&event->wipe, 0, sizeof(event->wipe)); kone_keep_values_up_to_date(kone, event); diff --git a/drivers/hid/hid-roccat-kone.h b/drivers/hid/hid-roccat-kone.h index 4a1a9cb76b08..65c800e3addc 100644 --- a/drivers/hid/hid-roccat-kone.h +++ b/drivers/hid/hid-roccat-kone.h @@ -152,11 +152,13 @@ struct kone_mouse_event { uint16_t x; uint16_t y; uint8_t wheel; /* up = 1, down = -1 */ - uint8_t tilt; /* right = 1, left = -1 */ - uint8_t unknown; - uint8_t event; - uint8_t value; /* press = 0, release = 1 */ - uint8_t macro_key; /* 0 to 8 */ + struct_group(wipe, + uint8_t tilt; /* right = 1, left = -1 */ + uint8_t unknown; + uint8_t event; + uint8_t value; /* press = 0, release = 1 */ + uint8_t macro_key; /* 0 to 8 */ + ); } __attribute__ ((__packed__)); enum kone_mouse_events {
In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memset(), avoid intentionally writing across neighboring fields. Add struct_group() to mark region of struct kone_mouse_event that should be initialized to zero. Cc: Stefan Achatz <erazor_de@users.sourceforge.net> Cc: Jiri Kosina <jikos@kernel.org> Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com> Cc: linux-input@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/hid/hid-roccat-kone.c | 2 +- drivers/hid/hid-roccat-kone.h | 12 +++++++----- 2 files changed, 8 insertions(+), 6 deletions(-)