Re: [PATCH] HID: hyperv: make pointer arithmetics understandable for FORTIFY_SOURCE

["Jürgen Groß" <jgross@suse.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1188 bytes --]

On 21.08.26 12:23, Jiri Kosina wrote:
> From: Jiri Kosina <jkosina@suse.com>
> 
> Commit 83df7b5fa6735b5084ecd2 ("HID: hyperv: add KUnit coverage for device info
> bounds") introduced this piece of code
> 
> 	report = ((u8 *)&info->hid_descriptor) + info->hid_descriptor.bLength;
> 	memset(report, 0x42, 4);
> 
> to populate the report descriptor, making use of the fact that the report.
> &info->hid_descriptor points to a struct hid_descriptor (which is a fixed-size struct)
> GCC's FORTIFY_SOURCE infer the object size from that specific struct field rather than the
> outer dynamically allocated info buffer. As a result, writing past sizeof(struct hid_descriptor)
> triggers the __write_overflow_field warning.
> 
> Calculate the pointer offset using info directly, so the compiler evaluates the
> memory bounds against the allocated flexible layout of struct
> synthhid_device_info instead of the nested struct.
> 
> Fixes: 83df7b5fa6735b5084ecd2 ("HID: hyperv: add KUnit coverage for device info bounds")
> Reported-by: Jürgen Groß <jgross@suse.com>
> Signed-off-by: Jiri Kosina <jkosina@suse.com>

Tested-by: Jürgen Groß <jgross@suse.com>


Jürgen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]