> virtio_gpio_get_names() walks the line names that the device returns in
> a block of gpio_names_size bytes, which the driver ends with a NUL, and
> checks each name only after stepping past it. If the block holds fewer
> than ngpio names, the walk reaches the end of the block after the last
> name, and the next iteration starts strlen() at the byte after the
> allocation. With a block that holds one name for four lines, KASAN
> reports:
>
> BUG: KASAN: slab-out-of-bounds in strlen+0x57/0x70
> Read of size 1 at addr ffff8880026687c0 by task swapper/0/1
> Call Trace:
> strlen+0x57/0x70
> virtio_gpio_probe+0xcb4/0xfc0
> virtio_dev_probe+0xa7a/0xc50
> Allocated by task 1:
> devm_kmalloc+0x6e/0x280
> virtio_gpio_probe+0xc06/0xfc0
> The buggy address is located 0 bytes to the right of
> allocated 64-byte region [ffff888002668780, ffff8880026687c0)
>
> Check that a name starts inside the block before reading it.
>
> This patch is assisted by Claude Opus 5.5.
>
> Fixes: 3a29355a22c0 ("gpio: Add virtio-gpio driver")
> Cc: [email protected]
> Signed-off-by: Lianjie Wang <[email protected]>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=1
