-
Notifications
You must be signed in to change notification settings - Fork 14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
error: call to ‘__read_overflow2’ declared with attribute error: detected read beyond size of object passed as 2nd parameter #1
Comments
Thanks for this report. The driver was doing instead of Counting the closing NULL, the string is a lot shorter than BTC_RSN_MAXLEN, which is defined as 32. With this fix, the driver compiles cleanly, AND runs. I am using it now to send this message. |
lwfinger
added a commit
that referenced
this issue
Jun 9, 2022
The macro hal_mem_cpy(} has several places that can overrun either the source or destination size. These overruns can lead to kernel bugs such as: detected buffer overflow in memcpy ------------[ cut here ]------------ kernel BUG at lib/string_helpers.c:983! invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 0 PID: 5364 Comm: insmod Tainted: G OE 5.19.0-rc1-00009-g74de34150d21 #848 35456bf5857cb1> Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.50 09/29/2014 RIP: 0010:fortify_panic+0xf/0x11 Code: c7 c7 60 94 70 b8 48 89 d6 e8 b6 21 fe ff 48 89 df e8 ad f6 2e ff e9 9f 3d 70 ff 48 89 fe 48 c7 c7 a0 > RSP: 0018:ffff8881ac4df310 EFLAGS: 00010282 RAX: 0000000000000022 RBX: ffffc9000112d000 RCX: 0000000000000000 RDX: 0000000000000022 RSI: 0000000000000008 RDI: ffffed103589be55 RBP: ffffc9000112e010 R08: 0000000000000001 R09: ffff8882b1642e6f R10: ffffed10562c85cd R11: 0000000000000000 R12: 0000000000000004 R13: ffffc9000083f000 R14: ffffc90000944000 R15: ffff888108c40000 FS: 00007ff77b7a2740(0000) GS:ffff8882b1600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f463f9417ae CR3: 0000000143652006 CR4: 00000000001706f0 Call Trace: <TASK> hal_btc_init+0x15d/0x15d [8852be a3b49b18f720e4d07e8f1c83740002efbd8d05f6] This problem arises in hal_btc_init() from the code "_rsn_cpy(btc->dm.run_reason, "None");" The macro _rsn_cpy() calls hal_mem_cpy() with a size argument of BTC_RSN_MAXLEN (32) which is much larger than the 5 bytes of the string "none". There are other instances where the size of the item to be copied is greater than than the size of the destination. Accordingly macro hal_mem_cpy() is changed to test the copy size against the sizes of the source and the destination. With this change, the driver works. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Thanks;) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi! I am trying to install wifi driver on xiaomi redmi 15 ryzen edition laptop.
The text was updated successfully, but these errors were encountered: