Skip to content

Commit 838ae9f

Browse files
keesdakr
authored andcommitted
nouveau/gsp: Avoid addressing beyond end of rpc->entries
Using the end of rpc->entries[] for addressing runs into both compile-time and run-time detection of accessing beyond the end of the array. Use the base pointer instead, since was allocated with the additional bytes for storing the strings. Avoids the following warning in future GCC releases with support for __counted_by: In function 'fortify_memcpy_chk', inlined from 'r535_gsp_rpc_set_registry' at ../drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c:1123:3: ../include/linux/fortify-string.h:553:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 553 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ for this code: strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES]; ... memcpy(strings, r535_registry_entries[i].name, name_len); Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Danilo Krummrich <dakr@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240330141159.work.063-kees@kernel.org
1 parent 07ed11a commit 838ae9f

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

  • drivers/gpu/drm/nouveau/nvkm/subdev/gsp

drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r535.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1112,7 +1112,7 @@ r535_gsp_rpc_set_registry(struct nvkm_gsp *gsp)
11121112
rpc->numEntries = NV_GSP_REG_NUM_ENTRIES;
11131113

11141114
str_offset = offsetof(typeof(*rpc), entries[NV_GSP_REG_NUM_ENTRIES]);
1115-
strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES];
1115+
strings = (char *)rpc + str_offset;
11161116
for (i = 0; i < NV_GSP_REG_NUM_ENTRIES; i++) {
11171117
int name_len = strlen(r535_registry_entries[i].name) + 1;
11181118

0 commit comments

Comments
 (0)