github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: hyperv: make pointer arithmetics understandable for FORTIFY_SOURCE

Browse Source 
Commit 83df7b5fa6 ("HID: hyperv: add KUnit coverage for device info
bounds") introduced this piece of code

	report = ((u8 *)&info->hid_descriptor) + info->hid_descriptor.bLength;
	memset(report, 0x42, 4);

to populate the report, making use of the fact that the report
&info->hid_descriptor points to a struct hid_descriptor (which is a fixed-size
struct).

GCC's FORTIFY_SOURCE infer the object size from that specific struct field
rather than the outer dynamically allocated info buffer. As a result, writing
past sizeof(struct hid_descriptor) triggers the __write_overflow_field warning.

Calculate the pointer offset using info directly, so the compiler evaluates the
memory bounds against the allocated flexible layout of struct
synthhid_device_info instead of the nested struct.

Fixes: 83df7b5fa6 ("HID: hyperv: add KUnit coverage for device info bounds")
Reported-by: Jürgen Groß <jgross@suse.com>
Tested-by: Jürgen Groß <jgross@suse.com>
Acked-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Jiri Kosina 2026-08-21 15:39:15 +02:00 committed by Jiri Kosina
parent 445fcd33c5
commit d0ad81b2b5
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/hid/hid-hyperv.c
View File

@ -687,7 +687,7 @@ static void mousevsc_device_info_valid_descriptor(struct kunit *test)
info->hid_descriptor.bLength = sizeof(struct hid_descriptor);
info->hid_descriptor.rpt_desc.wDescriptorLength = cpu_to_le16(4);
report = ((u8 *)&info->hid_descriptor) + info->hid_descriptor.bLength;
report = (u8 *)(info + 1);
memset(report, 0x42, 4);
mousevsc_on_receive_device_info(input_dev, info, sizeof(*info) + 4);
@ -713,7 +713,7 @@ static void mousevsc_device_info_report_desc_oob(struct kunit *test)
info->hid_descriptor.bLength = sizeof(struct hid_descriptor);
info->hid_descriptor.rpt_desc.wDescriptorLength = cpu_to_le16(64);
report = ((u8 *)&info->hid_descriptor) + info->hid_descriptor.bLength;
report = (u8 *)(info + 1);
memset(report, 0x42, 8);
mousevsc_on_receive_device_info(input_dev, info, sizeof(*info) + 8);