On Tue, Feb 27, 2024 at 11:14 AM Daniel Lezcano <[email protected]> wrote: > > On 27/02/2024 01:54, Nathan Chancellor wrote: > > When booting a CONFIG_FORTIFY_SOURCE=y kernel compiled with a toolchain > > that supports __counted_by() (such as clang-18 and newer), there is a > > panic on boot: > > > > [ 2.913770] memcpy: detected buffer overflow: 72 byte write of buffer > > size 0 > > [ 2.920834] WARNING: CPU: 2 PID: 1 at lib/string_helpers.c:1027 > > __fortify_report+0x5c/0x74 > > ... > > [ 3.039208] Call trace: > > [ 3.041643] __fortify_report+0x5c/0x74 > > [ 3.045469] __fortify_panic+0x18/0x20 > > [ 3.049209] thermal_zone_device_register_with_trips+0x4c8/0x4f8 > > > > This panic occurs because trips is counted by num_trips but num_trips is > > assigned after the call to memcpy(), so the fortify checks think the > > buffer size is zero because tz was allocated with kzalloc(). > > > > Move the num_trips assignment before the memcpy() to resolve the panic > > and ensure that the fortify checks work properly. > > > > Fixes: 9b0a62758665 ("thermal: core: Store zone trips table in struct > > thermal_zone_device") > > Signed-off-by: Nathan Chancellor <[email protected]> > > --- > > drivers/thermal/thermal_core.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c > > index bb21f78b4bfa..1eabc8ebe27d 100644 > > --- a/drivers/thermal/thermal_core.c > > +++ b/drivers/thermal/thermal_core.c > > @@ -1354,8 +1354,8 @@ thermal_zone_device_register_with_trips(const char > > *type, > > > > tz->device.class = thermal_class; > > tz->devdata = devdata; > > - memcpy(tz->trips, trips, num_trips * sizeof(*trips)); > > tz->num_trips = num_trips; > > + memcpy(tz->trips, trips, num_trips * sizeof(*trips)); > > IIUC, clang-18 is used and supports __counted_by(). > > Is it possible sizeof(*trips) returns already the real trips array size > and we are multiplying it again by num_trips ? > > While with an older compiler, __counted_by() does nothing and we have to > multiply by num_trips ? > > IOW, the array size arithmetic is different depending if we have > _counted_by supported or not ?
IIUC it is just the instrumentation using the current value of tz->num_trips (which is 0 before the initialization).
