On Thu, Mar 02, 2023 at 02:49:50PM -0800, Kees Cook wrote: > Under CONFIG_FORTIFY_SOURCE, memcpy() will check the size of destination > and source buffers. Defining kernel_headers_data as "char" would trip > this check. Since these addresses are treated as byte arrays, define > them as arrays (as done everywhere else). > > This was seen with: > > $ cat /sys/kernel/kheaders.tar.xz >> /dev/null > > detected buffer overflow in memcpy > kernel BUG at lib/string_helpers.c:1027! > ... > RIP: 0010:fortify_panic+0xf/0x20 > [...] > Call Trace: > <TASK> > ikheaders_read+0x45/0x50 [kheaders] > kernfs_fop_read_iter+0x1a4/0x2f0 > ... > > Reported-by: Jakub Kicinski <kuba@xxxxxxxxxx> > Link: https://lore.kernel.org/bpf/20230302112130.6e402a98@xxxxxxxxxx/ > Tested-by: Jakub Kicinski <kuba@xxxxxxxxxx> Acked-by: Joel Fernandes (Google) <joel@xxxxxxxxxxxxxxxxx> thanks, - Joel > Fixes: 43d8ce9d65a5 ("Provide in-kernel headers to make extending kernel easier") > Cc: Joel Fernandes (Google) <joel@xxxxxxxxxxxxxxxxx> > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> > --- > kernel/kheaders.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/kernel/kheaders.c b/kernel/kheaders.c > index 8f69772af77b..42163c9e94e5 100644 > --- a/kernel/kheaders.c > +++ b/kernel/kheaders.c > @@ -26,15 +26,15 @@ asm ( > " .popsection \n" > ); > > -extern char kernel_headers_data; > -extern char kernel_headers_data_end; > +extern char kernel_headers_data[]; > +extern char kernel_headers_data_end[]; > > static ssize_t > ikheaders_read(struct file *file, struct kobject *kobj, > struct bin_attribute *bin_attr, > char *buf, loff_t off, size_t len) > { > - memcpy(buf, &kernel_headers_data + off, len); > + memcpy(buf, &kernel_headers_data[off], len); > return len; > } > > @@ -48,8 +48,8 @@ static struct bin_attribute kheaders_attr __ro_after_init = { > > static int __init ikheaders_init(void) > { > - kheaders_attr.size = (&kernel_headers_data_end - > - &kernel_headers_data); > + kheaders_attr.size = (kernel_headers_data_end - > + kernel_headers_data); > return sysfs_create_bin_file(kernel_kobj, &kheaders_attr); > } > > -- > 2.34.1 >
