提交 413c0dd1 编写于 作者: K Kees Cook 提交者: Zheng Zengkai

gcc-plugins/stackleak: Exactly match strings instead of prefixes

stable inclusion
from stable-v5.10.110
commit 9d1d8e5e42941d3a51f7cde3bee93c2b47838aaa
bugzilla: https://gitee.com/openeuler/kernel/issues/I574AL

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9d1d8e5e42941d3a51f7cde3bee93c2b47838aaa

--------------------------------

[ Upstream commit 27e9faf4 ]

Since STRING_CST may not be NUL terminated, strncmp() was used for check
for equality. However, this may lead to mismatches for longer section
names where the start matches the tested-for string. Test for exact
equality by checking for the presences of NUL termination.

Cc: Alexander Popov <alex.popov@linux.com>
Signed-off-by: NKees Cook <keescook@chromium.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: NYu Liao <liaoyu15@huawei.com>
Reviewed-by: NWei Li <liwei391@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
上级 fc870f93
...@@ -431,6 +431,23 @@ static unsigned int stackleak_cleanup_execute(void) ...@@ -431,6 +431,23 @@ static unsigned int stackleak_cleanup_execute(void)
return 0; return 0;
} }
/*
* STRING_CST may or may not be NUL terminated:
* https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html
*/
static inline bool string_equal(tree node, const char *string, int length)
{
if (TREE_STRING_LENGTH(node) < length)
return false;
if (TREE_STRING_LENGTH(node) > length + 1)
return false;
if (TREE_STRING_LENGTH(node) == length + 1 &&
TREE_STRING_POINTER(node)[length] != '\0')
return false;
return !memcmp(TREE_STRING_POINTER(node), string, length);
}
#define STRING_EQUAL(node, str) string_equal(node, str, strlen(str))
static bool stackleak_gate(void) static bool stackleak_gate(void)
{ {
tree section; tree section;
...@@ -440,13 +457,13 @@ static bool stackleak_gate(void) ...@@ -440,13 +457,13 @@ static bool stackleak_gate(void)
if (section && TREE_VALUE(section)) { if (section && TREE_VALUE(section)) {
section = TREE_VALUE(TREE_VALUE(section)); section = TREE_VALUE(TREE_VALUE(section));
if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10)) if (STRING_EQUAL(section, ".init.text"))
return false; return false;
if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13)) if (STRING_EQUAL(section, ".devinit.text"))
return false; return false;
if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13)) if (STRING_EQUAL(section, ".cpuinit.text"))
return false; return false;
if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13)) if (STRING_EQUAL(section, ".meminit.text"))
return false; return false;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册